[webkit-changes] [126932] trunk

Tue, 28 Aug 2012 14:57:56 -0700

Title: [126932] trunk
Revision
126932
Author
[email protected]
Date
2012-08-28 14:58:35 -0700 (Tue, 28 Aug 2012)

Log Message

AX: Crash due to object getting deleted inside updateBackingStore
https://bugs.webkit.org/show_bug.cgi?id=94619

Reviewed by Chris Fleizach.

Source/WebKit/chromium:

Chromium now calls updateBackingStoreAndCheckValidity explicitly,
so we can now get rid of calls to updateBackingStore in the
method implementations, and just make sure we're checking isDetached.

* public/WebAccessibilityObject.h:
(WebAccessibilityObject):
* src/WebAccessibilityObject.cpp:
(WebKit::WebAccessibilityObject::axID):
(WebKit::WebAccessibilityObject::accessibilityDescription):
(WebKit::WebAccessibilityObject::actionVerb):
(WebKit::WebAccessibilityObject::canSetFocusAttribute):
(WebKit::WebAccessibilityObject::canSetValueAttribute):
(WebKit::WebAccessibilityObject::childCount):
(WebKit::WebAccessibilityObject::childAt):
(WebKit::WebAccessibilityObject::firstChild):
(WebKit::WebAccessibilityObject::focusedChild):
(WebKit::WebAccessibilityObject::lastChild):
(WebKit::WebAccessibilityObject::nextSibling):
(WebKit::WebAccessibilityObject::parentObject):
(WebKit::WebAccessibilityObject::previousSibling):
(WebKit::WebAccessibilityObject::canSetSelectedAttribute):
(WebKit::WebAccessibilityObject::isAnchor):
(WebKit::WebAccessibilityObject::isAriaReadOnly):
(WebKit::WebAccessibilityObject::isButtonStateMixed):
(WebKit::WebAccessibilityObject::isChecked):
(WebKit::WebAccessibilityObject::isCollapsed):
(WebKit::WebAccessibilityObject::isControl):
(WebKit::WebAccessibilityObject::isEnabled):
(WebKit::WebAccessibilityObject::isFocused):
(WebKit::WebAccessibilityObject::isHovered):
(WebKit::WebAccessibilityObject::isIndeterminate):
(WebKit::WebAccessibilityObject::isLinked):
(WebKit::WebAccessibilityObject::isLoaded):
(WebKit::WebAccessibilityObject::isMultiSelectable):
(WebKit::WebAccessibilityObject::isOffScreen):
(WebKit::WebAccessibilityObject::isPasswordField):
(WebKit::WebAccessibilityObject::isPressed):
(WebKit::WebAccessibilityObject::isReadOnly):
(WebKit::WebAccessibilityObject::isRequired):
(WebKit::WebAccessibilityObject::isSelected):
(WebKit::WebAccessibilityObject::isSelectedOptionActive):
(WebKit::WebAccessibilityObject::isVertical):
(WebKit::WebAccessibilityObject::isVisible):
(WebKit::WebAccessibilityObject::isVisited):
(WebKit::WebAccessibilityObject::accessKey):
(WebKit::WebAccessibilityObject::ariaHasPopup):
(WebKit::WebAccessibilityObject::ariaLiveRegionAtomic):
(WebKit::WebAccessibilityObject::ariaLiveRegionBusy):
(WebKit::WebAccessibilityObject::ariaLiveRegionRelevant):
(WebKit::WebAccessibilityObject::ariaLiveRegionStatus):
(WebKit::WebAccessibilityObject::boundingBoxRect):
(WebKit::WebAccessibilityObject::estimatedLoadingProgress):
(WebKit::WebAccessibilityObject::helpText):
(WebKit::WebAccessibilityObject::headingLevel):
(WebKit::WebAccessibilityObject::hierarchicalLevel):
(WebKit::WebAccessibilityObject::hitTest):
(WebKit::WebAccessibilityObject::keyboardShortcut):
(WebKit::WebAccessibilityObject::performDefaultAction):
(WebKit::WebAccessibilityObject::roleValue):
(WebKit::WebAccessibilityObject::selectionEnd):
(WebKit::WebAccessibilityObject::selectionStart):
(WebKit::WebAccessibilityObject::stringValue):
(WebKit::WebAccessibilityObject::title):
(WebKit::WebAccessibilityObject::titleUIElement):
(WebKit::WebAccessibilityObject::url):
(WebKit::WebAccessibilityObject::valueDescription):
(WebKit::WebAccessibilityObject::valueForRange):
(WebKit::WebAccessibilityObject::maxValueForRange):
(WebKit::WebAccessibilityObject::minValueForRange):
(WebKit::WebAccessibilityObject::node):
(WebKit::WebAccessibilityObject::document):
(WebKit::WebAccessibilityObject::accessibilityIsIgnored):
(WebKit::WebAccessibilityObject::lineBreaks):
(WebKit::WebAccessibilityObject::columnCount):
(WebKit::WebAccessibilityObject::rowCount):
(WebKit::WebAccessibilityObject::cellForColumnAndRow):
(WebKit::WebAccessibilityObject::cellColumnIndex):
(WebKit::WebAccessibilityObject::cellColumnSpan):
(WebKit::WebAccessibilityObject::cellRowIndex):
(WebKit::WebAccessibilityObject::cellRowSpan):
(WebKit::WebAccessibilityObject::scrollToMakeVisible):
(WebKit::WebAccessibilityObject::scrollToMakeVisibleWithSubFocus):
(WebKit::WebAccessibilityObject::scrollToGlobalPoint):

Tools:

Change isValid to !isDetached after deleting isValid from
chromium WebAccessibilityObject as being redundant.

* DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp:
(AccessibilityUIElement::isValidGetterCallback):

Modified Paths

Diff

Modified: trunk/Source/WebKit/chromium/ChangeLog (126931 => 126932)


--- trunk/Source/WebKit/chromium/ChangeLog	2012-08-28 21:56:23 UTC (rev 126931)
+++ trunk/Source/WebKit/chromium/ChangeLog	2012-08-28 21:58:35 UTC (rev 126932)
@@ -1,3 +1,94 @@
+2012-08-28  Dominic Mazzoni  <[email protected]>
+
+        AX: Crash due to object getting deleted inside updateBackingStore
+        https://bugs.webkit.org/show_bug.cgi?id=94619
+
+        Reviewed by Chris Fleizach.
+
+        Chromium now calls updateBackingStoreAndCheckValidity explicitly,
+        so we can now get rid of calls to updateBackingStore in the
+        method implementations, and just make sure we're checking isDetached.
+
+        * public/WebAccessibilityObject.h:
+        (WebAccessibilityObject):
+        * src/WebAccessibilityObject.cpp:
+        (WebKit::WebAccessibilityObject::axID):
+        (WebKit::WebAccessibilityObject::accessibilityDescription):
+        (WebKit::WebAccessibilityObject::actionVerb):
+        (WebKit::WebAccessibilityObject::canSetFocusAttribute):
+        (WebKit::WebAccessibilityObject::canSetValueAttribute):
+        (WebKit::WebAccessibilityObject::childCount):
+        (WebKit::WebAccessibilityObject::childAt):
+        (WebKit::WebAccessibilityObject::firstChild):
+        (WebKit::WebAccessibilityObject::focusedChild):
+        (WebKit::WebAccessibilityObject::lastChild):
+        (WebKit::WebAccessibilityObject::nextSibling):
+        (WebKit::WebAccessibilityObject::parentObject):
+        (WebKit::WebAccessibilityObject::previousSibling):
+        (WebKit::WebAccessibilityObject::canSetSelectedAttribute):
+        (WebKit::WebAccessibilityObject::isAnchor):
+        (WebKit::WebAccessibilityObject::isAriaReadOnly):
+        (WebKit::WebAccessibilityObject::isButtonStateMixed):
+        (WebKit::WebAccessibilityObject::isChecked):
+        (WebKit::WebAccessibilityObject::isCollapsed):
+        (WebKit::WebAccessibilityObject::isControl):
+        (WebKit::WebAccessibilityObject::isEnabled):
+        (WebKit::WebAccessibilityObject::isFocused):
+        (WebKit::WebAccessibilityObject::isHovered):
+        (WebKit::WebAccessibilityObject::isIndeterminate):
+        (WebKit::WebAccessibilityObject::isLinked):
+        (WebKit::WebAccessibilityObject::isLoaded):
+        (WebKit::WebAccessibilityObject::isMultiSelectable):
+        (WebKit::WebAccessibilityObject::isOffScreen):
+        (WebKit::WebAccessibilityObject::isPasswordField):
+        (WebKit::WebAccessibilityObject::isPressed):
+        (WebKit::WebAccessibilityObject::isReadOnly):
+        (WebKit::WebAccessibilityObject::isRequired):
+        (WebKit::WebAccessibilityObject::isSelected):
+        (WebKit::WebAccessibilityObject::isSelectedOptionActive):
+        (WebKit::WebAccessibilityObject::isVertical):
+        (WebKit::WebAccessibilityObject::isVisible):
+        (WebKit::WebAccessibilityObject::isVisited):
+        (WebKit::WebAccessibilityObject::accessKey):
+        (WebKit::WebAccessibilityObject::ariaHasPopup):
+        (WebKit::WebAccessibilityObject::ariaLiveRegionAtomic):
+        (WebKit::WebAccessibilityObject::ariaLiveRegionBusy):
+        (WebKit::WebAccessibilityObject::ariaLiveRegionRelevant):
+        (WebKit::WebAccessibilityObject::ariaLiveRegionStatus):
+        (WebKit::WebAccessibilityObject::boundingBoxRect):
+        (WebKit::WebAccessibilityObject::estimatedLoadingProgress):
+        (WebKit::WebAccessibilityObject::helpText):
+        (WebKit::WebAccessibilityObject::headingLevel):
+        (WebKit::WebAccessibilityObject::hierarchicalLevel):
+        (WebKit::WebAccessibilityObject::hitTest):
+        (WebKit::WebAccessibilityObject::keyboardShortcut):
+        (WebKit::WebAccessibilityObject::performDefaultAction):
+        (WebKit::WebAccessibilityObject::roleValue):
+        (WebKit::WebAccessibilityObject::selectionEnd):
+        (WebKit::WebAccessibilityObject::selectionStart):
+        (WebKit::WebAccessibilityObject::stringValue):
+        (WebKit::WebAccessibilityObject::title):
+        (WebKit::WebAccessibilityObject::titleUIElement):
+        (WebKit::WebAccessibilityObject::url):
+        (WebKit::WebAccessibilityObject::valueDescription):
+        (WebKit::WebAccessibilityObject::valueForRange):
+        (WebKit::WebAccessibilityObject::maxValueForRange):
+        (WebKit::WebAccessibilityObject::minValueForRange):
+        (WebKit::WebAccessibilityObject::node):
+        (WebKit::WebAccessibilityObject::document):
+        (WebKit::WebAccessibilityObject::accessibilityIsIgnored):
+        (WebKit::WebAccessibilityObject::lineBreaks):
+        (WebKit::WebAccessibilityObject::columnCount):
+        (WebKit::WebAccessibilityObject::rowCount):
+        (WebKit::WebAccessibilityObject::cellForColumnAndRow):
+        (WebKit::WebAccessibilityObject::cellColumnIndex):
+        (WebKit::WebAccessibilityObject::cellColumnSpan):
+        (WebKit::WebAccessibilityObject::cellRowIndex):
+        (WebKit::WebAccessibilityObject::cellRowSpan):
+        (WebKit::WebAccessibilityObject::scrollToMakeVisible):
+        (WebKit::WebAccessibilityObject::scrollToMakeVisibleWithSubFocus):
+        (WebKit::WebAccessibilityObject::scrollToGlobalPoint):
+
 2012-08-28  Sheriff Bot  <[email protected]>
 
         Unreviewed, rolling out r126914.

Modified: trunk/Source/WebKit/chromium/public/WebAccessibilityObject.h (126931 => 126932)


--- trunk/Source/WebKit/chromium/public/WebAccessibilityObject.h	2012-08-28 21:56:23 UTC (rev 126931)
+++ trunk/Source/WebKit/chromium/public/WebAccessibilityObject.h	2012-08-28 21:58:35 UTC (rev 126932)
@@ -89,7 +89,6 @@
     WEBKIT_EXPORT WebString actionVerb() const;
     WEBKIT_EXPORT bool canSetFocusAttribute() const;
     WEBKIT_EXPORT bool canSetValueAttribute() const;
-    WEBKIT_EXPORT bool isValid() const;
 
     WEBKIT_EXPORT unsigned childCount() const;

Modified: trunk/Source/WebKit/chromium/src/WebAccessibilityObject.cpp (126931 => 126932)


--- trunk/Source/WebKit/chromium/src/WebAccessibilityObject.cpp	2012-08-28 21:56:23 UTC (rev 126931)
+++ trunk/Source/WebKit/chromium/src/WebAccessibilityObject.cpp	2012-08-28 21:58:35 UTC (rev 126932)
@@ -95,7 +95,6 @@
     if (isDetached())
         return -1;
 
-    m_private->updateBackingStore();
     return m_private->axObjectID();
 }
 
@@ -111,7 +110,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->accessibilityDescription();
 }
 
@@ -120,7 +118,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->actionVerb();
 }
 
@@ -129,7 +126,6 @@
     if (isDetached())
         return false;
 
-    m_private->updateBackingStore();
     return m_private->canSetFocusAttribute();
 }
 
@@ -138,25 +134,14 @@
     if (isDetached())
         return false;
 
-    m_private->updateBackingStore();
     return m_private->canSetValueAttribute();
 }
 
-bool WebAccessibilityObject::isValid() const
-{
-    if (isDetached())
-        return false;
-
-    m_private->updateBackingStore();
-    return m_private->axObjectID();
-}
-
 unsigned WebAccessibilityObject::childCount() const
 {
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->children().size();
 }
 
@@ -165,7 +150,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     if (m_private->children().size() <= index)
         return WebAccessibilityObject();
 
@@ -177,7 +161,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     return WebAccessibilityObject(m_private->firstChild());
 }
 
@@ -186,7 +169,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     RefPtr<AccessibilityObject> focused = m_private->focusedUIElement();
     if (m_private.get() == focused.get() || m_private.get() == focused->parentObject())
         return WebAccessibilityObject(focused);
@@ -199,7 +181,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     return WebAccessibilityObject(m_private->lastChild());
 }
 
@@ -209,7 +190,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     return WebAccessibilityObject(m_private->nextSibling());
 }
 
@@ -218,7 +198,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     return WebAccessibilityObject(m_private->parentObject());
 }
 
@@ -228,7 +207,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     return WebAccessibilityObject(m_private->previousSibling());
 }
 
@@ -237,7 +215,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->canSetSelectedAttribute();
 }
 
@@ -246,7 +223,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isAnchor();
 }
 
@@ -255,7 +231,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return equalIgnoringCase(m_private->getAttribute(HTMLNames::aria_readonlyAttr), "true");
 }
 
@@ -264,7 +239,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->checkboxOrRadioValue() == ButtonStateMixed;
 }
 
@@ -273,7 +247,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isChecked();
 }
 
@@ -282,7 +255,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isCollapsed();
 }
 
@@ -291,7 +263,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isControl();
 }
 
@@ -300,7 +271,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isEnabled();
 }
 
@@ -309,7 +279,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isFocused();
 }
 
@@ -318,7 +287,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isHovered();
 }
 
@@ -327,7 +295,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isIndeterminate();
 }
 
@@ -336,7 +303,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isLinked();
 }
 
@@ -345,7 +311,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isLoaded();
 }
 
@@ -354,7 +319,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isMultiSelectable();
 }
 
@@ -363,7 +327,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isOffScreen();
 }
 
@@ -372,7 +335,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isPasswordField();
 }
 
@@ -381,7 +343,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isPressed();
 }
 
@@ -390,7 +351,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isReadOnly();
 }
 
@@ -399,7 +359,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isRequired();
 }
 
@@ -408,7 +367,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isSelected();
 }
 
@@ -417,7 +375,6 @@
     if (isDetached())
         return false;
 
-    m_private->updateBackingStore();
     return m_private->isSelectedOptionActive();
 }
 
@@ -426,7 +383,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->orientation() == AccessibilityOrientationVertical;
 }
 
@@ -435,7 +391,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isVisible();
 }
 
@@ -444,7 +399,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->isVisited();
 }
 
@@ -453,7 +407,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return WebString(m_private->accessKey());
 }
 
@@ -462,7 +415,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->ariaHasPopup();
 }
 
@@ -471,7 +423,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->ariaLiveRegionAtomic();
 }
 
@@ -480,7 +431,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->ariaLiveRegionBusy();
 }
 
@@ -489,7 +439,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->ariaLiveRegionRelevant();
 }
 
@@ -498,7 +447,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->ariaLiveRegionStatus();
 }
 
@@ -507,7 +455,6 @@
     if (isDetached())
         return WebRect();
 
-    m_private->updateBackingStore();
     return m_private->pixelSnappedBoundingBoxRect();
 }
 
@@ -516,7 +463,6 @@
     if (isDetached())
         return 0.0;
 
-    m_private->updateBackingStore();
     return m_private->estimatedLoadingProgress();
 }
 
@@ -525,7 +471,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->helpText();
 }
 
@@ -534,7 +479,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->headingLevel();
 }
 
@@ -543,7 +487,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->hierarchicalLevel();
 }
 
@@ -552,7 +495,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     IntPoint contentsPoint = m_private->documentFrameView()->windowToContents(point);
     RefPtr<AccessibilityObject> hit = m_private->accessibilityHitTest(contentsPoint);
 
@@ -570,7 +512,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     String accessKey = m_private->accessKey();
     if (accessKey.isNull())
         return WebString();
@@ -601,7 +542,6 @@
 
     UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
 
-    m_private->updateBackingStore();
     return m_private->performDefaultAction();
 }
 
@@ -610,7 +550,6 @@
     if (isDetached())
         return WebKit::WebAccessibilityRoleUnknown;
 
-    m_private->updateBackingStore();
     return static_cast<WebAccessibilityRole>(m_private->roleValue());
 }
 
@@ -619,7 +558,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->selectedTextRange().start + m_private->selectedTextRange().length;
 }
 
@@ -628,7 +566,6 @@
     if (isDetached())
         return 0;
 
-    m_private->updateBackingStore();
     return m_private->selectedTextRange().start;
 }
 
@@ -643,7 +580,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->stringValue();
 }
 
@@ -652,7 +588,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->title();
 }
 
@@ -661,7 +596,6 @@
     if (isDetached())
         return WebAccessibilityObject();
 
-    m_private->updateBackingStore();
     return WebAccessibilityObject(m_private->titleUIElement());
 }
 
@@ -670,7 +604,6 @@
     if (isDetached())
         return WebURL();
     
-    m_private->updateBackingStore();
     return m_private->url();
 }
 
@@ -679,7 +612,6 @@
     if (isDetached())
         return WebString();
 
-    m_private->updateBackingStore();
     return m_private->valueDescription();
 }
 
@@ -688,7 +620,6 @@
     if (isDetached())
         return 0.0;
 
-    m_private->updateBackingStore();
     return m_private->valueForRange();
 }
 
@@ -697,7 +628,6 @@
     if (isDetached())
         return 0.0;
 
-    m_private->updateBackingStore();
     return m_private->maxValueForRange();
 }
 
@@ -706,7 +636,6 @@
     if (isDetached())
         return 0.0;
 
-    m_private->updateBackingStore();
     return m_private->minValueForRange();
 }
 
@@ -715,8 +644,6 @@
     if (isDetached())
         return WebNode();
 
-    m_private->updateBackingStore();
-
     Node* node = m_private->node();
     if (!node)
         return WebNode();
@@ -729,8 +656,6 @@
     if (isDetached())
         return WebDocument();
 
-    m_private->updateBackingStore();
-
     Document* document = m_private->document();
     if (!document)
         return WebDocument();
@@ -779,7 +704,6 @@
     if (isDetached())
         return false;
 
-    m_private->updateBackingStore();
     return m_private->accessibilityIsIgnored();
 }
 
@@ -788,7 +712,6 @@
     if (isDetached())
         return false;
 
-    m_private->updateBackingStore();
     int textLength = m_private->textLength();
     if (!textLength)
         return false;
@@ -812,7 +735,6 @@
     if (isDetached())
         return false;
 
-    m_private->updateBackingStore();
     if (!m_private->isAccessibilityTable())
         return 0;
 
@@ -824,7 +746,6 @@
     if (isDetached())
         return false;
 
-    m_private->updateBackingStore();
     if (!m_private->isAccessibilityTable())
         return 0;
 
@@ -833,7 +754,9 @@
 
 WebAccessibilityObject WebAccessibilityObject::cellForColumnAndRow(unsigned column, unsigned row) const
 {
-    m_private->updateBackingStore();
+    if (isDetached())
+        return WebAccessibilityObject();
+
     if (!m_private->isAccessibilityTable())
         return WebAccessibilityObject();
 
@@ -843,7 +766,9 @@
 
 unsigned WebAccessibilityObject::cellColumnIndex() const
 {
-    m_private->updateBackingStore();
+    if (isDetached())
+        return 0;
+
     if (!m_private->isTableCell())
        return 0;
 
@@ -854,7 +779,9 @@
 
 unsigned WebAccessibilityObject::cellColumnSpan() const
 {
-    m_private->updateBackingStore();
+    if (isDetached())
+        return 0;
+
     if (!m_private->isTableCell())
        return 0;
 
@@ -865,7 +792,9 @@
 
 unsigned WebAccessibilityObject::cellRowIndex() const
 {
-    m_private->updateBackingStore();
+    if (isDetached())
+        return 0;
+
     if (!m_private->isTableCell())
        return 0;
 
@@ -876,7 +805,9 @@
 
 unsigned WebAccessibilityObject::cellRowSpan() const
 {
-    m_private->updateBackingStore();
+    if (isDetached())
+        return 0;
+
     if (!m_private->isTableCell())
        return 0;
 
@@ -887,20 +818,20 @@
 
 void WebAccessibilityObject::scrollToMakeVisible() const
 {
-    m_private->updateBackingStore();
-    m_private->scrollToMakeVisible();
+    if (!isDetached())
+        m_private->scrollToMakeVisible();
 }
 
 void WebAccessibilityObject::scrollToMakeVisibleWithSubFocus(const WebRect& subfocus) const
 {
-    m_private->updateBackingStore();
-    m_private->scrollToMakeVisibleWithSubFocus(subfocus);
+    if (!isDetached())
+        m_private->scrollToMakeVisibleWithSubFocus(subfocus);
 }
 
 void WebAccessibilityObject::scrollToGlobalPoint(const WebPoint& point) const
 {
-    m_private->updateBackingStore();
-    m_private->scrollToGlobalPoint(point);
+    if (!isDetached())
+        m_private->scrollToGlobalPoint(point);
 }
 
 WebAccessibilityObject::WebAccessibilityObject(const WTF::PassRefPtr<WebCore::AccessibilityObject>& object)

Modified: trunk/Tools/ChangeLog (126931 => 126932)


--- trunk/Tools/ChangeLog	2012-08-28 21:56:23 UTC (rev 126931)
+++ trunk/Tools/ChangeLog	2012-08-28 21:58:35 UTC (rev 126932)
@@ -1,3 +1,16 @@
+2012-08-28  Dominic Mazzoni  <[email protected]>
+
+        AX: Crash due to object getting deleted inside updateBackingStore
+        https://bugs.webkit.org/show_bug.cgi?id=94619
+
+        Reviewed by Chris Fleizach.
+
+        Change isValid to !isDetached after deleting isValid from
+        chromium WebAccessibilityObject as being redundant.
+
+        * DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp:
+        (AccessibilityUIElement::isValidGetterCallback):
+
 2012-08-28  Sheriff Bot  <[email protected]>
 
         Unreviewed, rolling out r126914.

Modified: trunk/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp (126931 => 126932)


--- trunk/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp	2012-08-28 21:56:23 UTC (rev 126931)
+++ trunk/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp	2012-08-28 21:58:35 UTC (rev 126932)
@@ -547,7 +547,7 @@
 
 void AccessibilityUIElement::isValidGetterCallback(CppVariant* result)
 {
-    result->set(accessibilityObject().isValid());
+    result->set(!accessibilityObject().isDetached());
 }
 
 void AccessibilityUIElement::orientationGetterCallback(CppVariant* result)

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to