Title: [170704] trunk
- Revision
- 170704
- Author
- [email protected]
- Date
- 2014-07-02 02:52:38 -0700 (Wed, 02 Jul 2014)
Log Message
REGRESSION(r170008): [GTK] Layout Tests fast/forms/option-constructor-selected.html and fast/forms/select-live-pseudo-selectors.html crash.
https://bugs.webkit.org/show_bug.cgi?id=134399
Reviewed by Chris Fleizach.
Source/WebCore:
Check that the value of optionIndex passed as a parameter is valid
before calling didUpdateActiveOption() over the item of the menu
list, to prevent crashes in platforms where renderers (and therefore
accessibility objects) might not be created for items at the time
of calling AccessibilityMenuList::didUpdateActiveOption().
* accessibility/AccessibilityMenuList.cpp:
(WebCore::AccessibilityMenuList::didUpdateActiveOption): Added check.
LayoutTests:
Removing Crash expectations for two layout tests.
* platform/gtk/TestExpectations: Updated.
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (170703 => 170704)
--- trunk/LayoutTests/ChangeLog 2014-07-02 08:22:01 UTC (rev 170703)
+++ trunk/LayoutTests/ChangeLog 2014-07-02 09:52:38 UTC (rev 170704)
@@ -1,3 +1,14 @@
+2014-07-02 Mario Sanchez Prada <[email protected]>
+
+ REGRESSION(r170008): [GTK] Layout Tests fast/forms/option-constructor-selected.html and fast/forms/select-live-pseudo-selectors.html crash.
+ https://bugs.webkit.org/show_bug.cgi?id=134399
+
+ Reviewed by Chris Fleizach.
+
+ Removing Crash expectations for two layout tests.
+
+ * platform/gtk/TestExpectations: Updated.
+
2014-07-01 Frédéric Wang <[email protected]>
The OpenType MATH table is not read on Mac
Modified: trunk/LayoutTests/platform/gtk/TestExpectations (170703 => 170704)
--- trunk/LayoutTests/platform/gtk/TestExpectations 2014-07-02 08:22:01 UTC (rev 170703)
+++ trunk/LayoutTests/platform/gtk/TestExpectations 2014-07-02 09:52:38 UTC (rev 170704)
@@ -515,9 +515,6 @@
webkit.org/b/133797 fast/dom/NavigatorContentUtils/register-protocol-handler.html [ Crash ]
-webkit.org/b/134399 fast/forms/option-constructor-selected.html [ Crash ]
-webkit.org/b/134399 fast/forms/select-live-pseudo-selectors.html [ Crash ]
-
#////////////////////////////////////////////////////////////////////////////////////////
# End of Crashing tests
#////////////////////////////////////////////////////////////////////////////////////////
Modified: trunk/Source/WebCore/ChangeLog (170703 => 170704)
--- trunk/Source/WebCore/ChangeLog 2014-07-02 08:22:01 UTC (rev 170703)
+++ trunk/Source/WebCore/ChangeLog 2014-07-02 09:52:38 UTC (rev 170704)
@@ -1,3 +1,19 @@
+2014-07-02 Mario Sanchez Prada <[email protected]>
+
+ REGRESSION(r170008): [GTK] Layout Tests fast/forms/option-constructor-selected.html and fast/forms/select-live-pseudo-selectors.html crash.
+ https://bugs.webkit.org/show_bug.cgi?id=134399
+
+ Reviewed by Chris Fleizach.
+
+ Check that the value of optionIndex passed as a parameter is valid
+ before calling didUpdateActiveOption() over the item of the menu
+ list, to prevent crashes in platforms where renderers (and therefore
+ accessibility objects) might not be created for items at the time
+ of calling AccessibilityMenuList::didUpdateActiveOption().
+
+ * accessibility/AccessibilityMenuList.cpp:
+ (WebCore::AccessibilityMenuList::didUpdateActiveOption): Added check.
+
2014-07-02 Carlos Garcia Campos <[email protected]>
[GTK] Do not add forward declaration of class struct for interfaces
Modified: trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp (170703 => 170704)
--- trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2014-07-02 08:22:01 UTC (rev 170703)
+++ trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2014-07-02 09:52:38 UTC (rev 170704)
@@ -120,7 +120,8 @@
// before asking it to update its active option, or it will read invalid memory.
// You can reproduce the issue in the GTK+ port by removing this check and running
// accessibility/insert-selected-option-into-select-causes-crash.html (will crash).
- if (childObjects[0]->isMenuListPopup() && childObjects[0]->children().size()) {
+ int popupChildrenSize = static_cast<int>(childObjects[0]->children().size());
+ if (childObjects[0]->isMenuListPopup() && optionIndex >= 0 && optionIndex < popupChildrenSize) {
if (AccessibilityMenuListPopup* popup = toAccessibilityMenuListPopup(childObjects[0].get()))
popup->didUpdateActiveOption(optionIndex);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
