Title: [140393] trunk/Source/WebCore
- Revision
- 140393
- Author
- [email protected]
- Date
- 2013-01-22 00:33:45 -0800 (Tue, 22 Jan 2013)
Log Message
AX: Should assert if we try to create two AXObjects that point to the same renderer or node
https://bugs.webkit.org/show_bug.cgi?id=107504
Reviewed by Chris Fleizach.
If two accessibility objects get created that point to the
same widget, renderer, or node, that can lead to crashes or
memory corruption later; make it assert instead of crashing.
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::getOrCreate):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (140392 => 140393)
--- trunk/Source/WebCore/ChangeLog 2013-01-22 08:32:01 UTC (rev 140392)
+++ trunk/Source/WebCore/ChangeLog 2013-01-22 08:33:45 UTC (rev 140393)
@@ -1,3 +1,17 @@
+2013-01-22 Dominic Mazzoni <[email protected]>
+
+ AX: Should assert if we try to create two AXObjects that point to the same renderer or node
+ https://bugs.webkit.org/show_bug.cgi?id=107504
+
+ Reviewed by Chris Fleizach.
+
+ If two accessibility objects get created that point to the
+ same widget, renderer, or node, that can lead to crashes or
+ memory corruption later; make it assert instead of crashing.
+
+ * accessibility/AXObjectCache.cpp:
+ (WebCore::AXObjectCache::getOrCreate):
+
2013-01-22 Kentaro Hara <[email protected]>
[V8] Pass an Isolate to toV8()
Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (140392 => 140393)
--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2013-01-22 08:32:01 UTC (rev 140392)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2013-01-22 08:33:45 UTC (rev 140393)
@@ -305,6 +305,9 @@
newObj = AccessibilityScrollView::create(static_cast<ScrollView*>(widget));
else if (widget->isScrollbar())
newObj = AccessibilityScrollbar::create(static_cast<Scrollbar*>(widget));
+
+ // Will crash later if we have two objects for the same widget.
+ ASSERT(!get(widget));
getAXID(newObj.get());
@@ -337,6 +340,9 @@
RefPtr<AccessibilityObject> newObj = createFromNode(node);
+ // Will crash later if we have two objects for the same node.
+ ASSERT(!get(node));
+
getAXID(newObj.get());
m_nodeObjectMapping.set(node, newObj->axObjectID());
@@ -358,6 +364,9 @@
RefPtr<AccessibilityObject> newObj = createFromRenderer(renderer);
+ // Will crash later if we have two objects for the same renderer.
+ ASSERT(!get(renderer));
+
getAXID(newObj.get());
m_renderObjectMapping.set(renderer, newObj->axObjectID());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
