Title: [119626] branches/chromium/1132
- Revision
- 119626
- Author
- [email protected]
- Date
- 2012-06-06 15:38:25 -0700 (Wed, 06 Jun 2012)
Log Message
Merge 118213
BUG=127371
Review URL: https://chromiumcodereview.appspot.com/10543038
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/accessibility/content-changed-notification-causes-crash-expected.txt (from rev 118213, trunk/LayoutTests/accessibility/content-changed-notification-causes-crash-expected.txt) (0 => 119626)
--- branches/chromium/1132/LayoutTests/accessibility/content-changed-notification-causes-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/accessibility/content-changed-notification-causes-crash-expected.txt 2012-06-06 22:38:25 UTC (rev 119626)
@@ -0,0 +1,11 @@
+>>
+Ensures that this snippet does not lead to a crash. Bug 86029.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS. WebKit did not crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/1132/LayoutTests/accessibility/content-changed-notification-causes-crash.html (from rev 118213, trunk/LayoutTests/accessibility/content-changed-notification-causes-crash.html) (0 => 119626)
--- branches/chromium/1132/LayoutTests/accessibility/content-changed-notification-causes-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/accessibility/content-changed-notification-causes-crash.html 2012-06-06 22:38:25 UTC (rev 119626)
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+<div id="group" tabindex="0">
+
+<ul role=textbox style='-webkit-transition: -webkit-transform linear 1117401740208157342s; content: counters(c, ".", disc); '>><keygen autofocus="">><body style='outline-style: ridge; font: normal normal 29266em/9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 Ahem, serif; '>
+
+</div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+ description("Ensures that this snippet does not lead to a crash. Bug 86029.");
+
+ function walkAccessibilityTree(accessibilityObject) {
+ var count = accessibilityObject.childrenCount;
+ for (var i = 0; i < count; ++i)
+ accessibilityObject.childAtIndex(i);
+ }
+
+ if (window.accessibilityController) {
+
+ document.getElementById("group").focus();
+ var focusedElement = accessibilityController.focusedElement;
+ walkAccessibilityTree(focusedElement);
+
+ document.getElementById('console').innerHTML += "PASS. WebKit did not crash.<br>";
+ }
+</script>
+
+<script src=""
+</body>
+</html>
Modified: branches/chromium/1132/Source/WebCore/accessibility/AccessibilityObject.h (119625 => 119626)
--- branches/chromium/1132/Source/WebCore/accessibility/AccessibilityObject.h 2012-06-06 22:30:26 UTC (rev 119625)
+++ branches/chromium/1132/Source/WebCore/accessibility/AccessibilityObject.h 2012-06-06 22:38:25 UTC (rev 119626)
@@ -313,7 +313,8 @@
public:
virtual ~AccessibilityObject();
virtual void detach();
-
+ virtual bool isDetached() const { return true; }
+
typedef Vector<RefPtr<AccessibilityObject> > AccessibilityChildrenVector;
virtual bool isAccessibilityRenderObject() const { return false; }
@@ -707,7 +708,6 @@
virtual ScrollableArea* getScrollableAreaIfScrollable() const { return 0; }
virtual void scrollTo(const IntPoint&) const { }
- virtual bool isDetached() const { return true; }
static bool isAccessibilityObjectSearchMatch(AccessibilityObject*, AccessibilitySearchCriteria*);
static bool isAccessibilityTextSearchMatch(AccessibilityObject*, AccessibilitySearchCriteria*);
static bool objectMatchesSearchCriteriaWithResultLimit(AccessibilityObject*, AccessibilitySearchCriteria*, AccessibilityChildrenVector&);
Modified: branches/chromium/1132/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (119625 => 119626)
--- branches/chromium/1132/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2012-06-06 22:30:26 UTC (rev 119625)
+++ branches/chromium/1132/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2012-06-06 22:38:25 UTC (rev 119626)
@@ -3428,8 +3428,14 @@
if (parent->supportsARIALiveRegion())
cache->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
- if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->isContentEditable())
+ if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->isContentEditable()) {
+ // isContentEditable() might trigger a layout update and invalidate the parent.
+ ASSERT(!parent->renderer() || parent->renderer() == renderParent);
+ if (parent->isDetached())
+ break;
+
cache->postNotification(renderParent, AXObjectCache::AXValueChanged, true);
+ }
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
