Title: [142631] trunk
- Revision
- 142631
- Author
- [email protected]
- Date
- 2013-02-12 08:58:39 -0800 (Tue, 12 Feb 2013)
Log Message
ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
https://bugs.webkit.org/show_bug.cgi?id=109452
Reviewed by Chris Fleizach.
Source/WebCore:
Send the accessibility childrenChanged notification in
HTMLSelectElement::setRecalcListItems instead of in childrenChanged
so that all possible codepaths are caught.
Test: accessibility/insert-selected-option-into-select-causes-crash.html
* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::childrenChanged):
(WebCore::HTMLSelectElement::setRecalcListItems):
LayoutTests:
Add test to ensure a crash doesn't happen if a selected option
is added to a select element, which was triggering a code path where
the DOM has added a new child of the select but the accessibility
object never got updated.
* accessibility/insert-selected-option-into-select-causes-crash-expected.txt: Added.
* accessibility/insert-selected-option-into-select-causes-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (142630 => 142631)
--- trunk/LayoutTests/ChangeLog 2013-02-12 16:55:47 UTC (rev 142630)
+++ trunk/LayoutTests/ChangeLog 2013-02-12 16:58:39 UTC (rev 142631)
@@ -1,3 +1,18 @@
+2013-02-12 Dominic Mazzoni <[email protected]>
+
+ ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
+ https://bugs.webkit.org/show_bug.cgi?id=109452
+
+ Reviewed by Chris Fleizach.
+
+ Add test to ensure a crash doesn't happen if a selected option
+ is added to a select element, which was triggering a code path where
+ the DOM has added a new child of the select but the accessibility
+ object never got updated.
+
+ * accessibility/insert-selected-option-into-select-causes-crash-expected.txt: Added.
+ * accessibility/insert-selected-option-into-select-causes-crash.html: Added.
+
2013-02-12 Peter Rybin <[email protected]>
Web Inspector: for event listener provide handler function value in protocol and in UI
Added: trunk/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash-expected.txt (0 => 142631)
--- trunk/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash-expected.txt 2013-02-12 16:58:39 UTC (rev 142631)
@@ -0,0 +1,9 @@
+This test ensures that inserting a selected option into an HTML Select element doesn't cause a crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash.html (0 => 142631)
--- trunk/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash.html (rev 0)
+++ trunk/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash.html 2013-02-12 16:58:39 UTC (rev 142631)
@@ -0,0 +1,36 @@
+<!doctype html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<select id="popup">
+ <optgroup id=optgroup1>
+ </optgroup>
+</select>
+<select id="listbox" multiple>
+ <optgroup id=optgroup2>
+ <option selected>
+ </optgroup>
+</select>
+
+<script>
+ description("This test ensures that inserting a selected option into an HTML Select element doesn't cause a crash.");
+
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var optgroup1 = document.getElementById('optgroup1');
+ var optgroup2 = document.getElementById('optgroup2');
+
+ if (window.accessibilityController)
+ accessibilityController.accessibleElementById('dummy');
+
+ var listbox = document.getElementById('listbox');
+ listbox.focus();
+
+ optgroup1.appendChild(optgroup2);
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (142630 => 142631)
--- trunk/Source/WebCore/ChangeLog 2013-02-12 16:55:47 UTC (rev 142630)
+++ trunk/Source/WebCore/ChangeLog 2013-02-12 16:58:39 UTC (rev 142631)
@@ -1,3 +1,20 @@
+2013-02-12 Dominic Mazzoni <[email protected]>
+
+ ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
+ https://bugs.webkit.org/show_bug.cgi?id=109452
+
+ Reviewed by Chris Fleizach.
+
+ Send the accessibility childrenChanged notification in
+ HTMLSelectElement::setRecalcListItems instead of in childrenChanged
+ so that all possible codepaths are caught.
+
+ Test: accessibility/insert-selected-option-into-select-causes-crash.html
+
+ * html/HTMLSelectElement.cpp:
+ (WebCore::HTMLSelectElement::childrenChanged):
+ (WebCore::HTMLSelectElement::setRecalcListItems):
+
2013-02-12 Peter Rybin <[email protected]>
Web Inspector: for event listener provide handler function value in protocol and in UI
Modified: trunk/Source/WebCore/html/HTMLSelectElement.cpp (142630 => 142631)
--- trunk/Source/WebCore/html/HTMLSelectElement.cpp 2013-02-12 16:55:47 UTC (rev 142630)
+++ trunk/Source/WebCore/html/HTMLSelectElement.cpp 2013-02-12 16:58:39 UTC (rev 142631)
@@ -373,9 +373,6 @@
setNeedsValidityCheck();
HTMLFormControlElementWithState::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
- if (AXObjectCache::accessibilityEnabled() && renderer())
- renderer()->document()->axObjectCache()->childrenChanged(this);
}
void HTMLSelectElement::optionElementChildrenChanged()
@@ -724,6 +721,9 @@
}
if (!inDocument())
invalidateSelectedItems();
+
+ if (AXObjectCache::accessibilityEnabled() && renderer())
+ renderer()->document()->axObjectCache()->childrenChanged(this);
}
void HTMLSelectElement::recalcListItems(bool updateSelectedStates) const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
