Title: [176389] releases/WebKitGTK/webkit-2.6
- Revision
- 176389
- Author
- [email protected]
- Date
- 2014-11-20 01:04:24 -0800 (Thu, 20 Nov 2014)
Log Message
Merge r176254 - AX: [ATK] Crash getting the orientation of a MenuListOption after the MenuList was removed from the document
https://bugs.webkit.org/show_bug.cgi?id=138727
Reviewed by Chris Fleizach.
Source/WebCore:
AccessibilityMenuListOption::elementRect() returns the value of the
grandparent MenuList, asserting that the grandparent exists with that
role. But it is possible to have an existing MenuListOption and remove
the element which had been backing that MenuList from the document.
Adding null checks prior to the assertions prevents our crashing if the
parent or grandparent was removed.
Test: platform/gtk/accessibility/combobox-descendants-orientation-crash.html
* accessibility/AccessibilityMenuListOption.cpp:
(WebCore::AccessibilityMenuListOption::elementRect):
LayoutTests:
* platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt: Added.
* platform/gtk/accessibility/combobox-descendants-orientation-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog (176388 => 176389)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog 2014-11-20 08:43:25 UTC (rev 176388)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog 2014-11-20 09:04:24 UTC (rev 176389)
@@ -1,3 +1,13 @@
+2014-11-18 Joanmarie Diggs <[email protected]>
+
+ AX: [ATK] Crash getting the orientation of a MenuListOption after the MenuList was removed from the document
+ https://bugs.webkit.org/show_bug.cgi?id=138727
+
+ Reviewed by Chris Fleizach.
+
+ * platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt: Added.
+ * platform/gtk/accessibility/combobox-descendants-orientation-crash.html: Added.
+
2014-11-16 Chris Dumez <[email protected]>
Assertion hit when setting a very large value to 'border-width' / 'font-size' CSS properties
Added: releases/WebKitGTK/webkit-2.6/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt (0 => 176389)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt 2014-11-20 09:04:24 UTC (rev 176389)
@@ -0,0 +1,18 @@
+This verifies that getting the orientation of combobox descendants won't crash if the combobox is removed from the document.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+AXRole: AXComboBox has orientation: AXOrientation: AXHorizontalOrientation
+
+Before combobox removal
+AXRole: AXMenu has orientation: AXOrientation: AXHorizontalOrientation
+AXRole: AXMenuItem has orientation: AXOrientation: AXHorizontalOrientation
+
+After combobox removal
+AXRole: AXInvalid has orientation: AXOrientation: AXHorizontalOrientation
+AXRole: AXInvalid has orientation: AXOrientation: AXHorizontalOrientation
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-2.6/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash.html (0 => 176389)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash.html 2014-11-20 09:04:24 UTC (rev 176389)
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<select id="combobox">
+<option value="foo">foo</option>
+<option value="bar">bar</option>
+</select>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This verifies that getting the orientation of combobox descendants won't crash if the combobox is removed from the document.");
+
+if (window.testRunner && window.accessibilityController) {
+ var combobox = document.getElementById("combobox");
+ combobox.focus();
+
+ var axCombobox = accessibilityController.focusedElement;
+ var axMenu = axCombobox.childAtIndex(0);
+ var axMenuItem = axMenu.childAtIndex(0);
+
+ debug(axCombobox.role + " has orientation: " + axCombobox.orientation);
+
+ debug("\nBefore combobox removal");
+ debug(axMenu.role + " has orientation: " + axMenu.orientation);
+ debug(axMenuItem.role + " has orientation: " + axMenuItem.orientation);
+
+ document.body.removeChild(combobox);
+ debug("\nAfter combobox removal");
+ debug(axMenu.role + " has orientation: " + axMenu.orientation);
+ debug(axMenuItem.role + " has orientation: " + axMenuItem.orientation);
+}
+</script>
+<script src=""
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog (176388 => 176389)
--- releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog 2014-11-20 08:43:25 UTC (rev 176388)
+++ releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog 2014-11-20 09:04:24 UTC (rev 176389)
@@ -1,3 +1,22 @@
+2014-11-18 Joanmarie Diggs <[email protected]>
+
+ AX: [ATK] Crash getting the orientation of a MenuListOption after the MenuList was removed from the document
+ https://bugs.webkit.org/show_bug.cgi?id=138727
+
+ Reviewed by Chris Fleizach.
+
+ AccessibilityMenuListOption::elementRect() returns the value of the
+ grandparent MenuList, asserting that the grandparent exists with that
+ role. But it is possible to have an existing MenuListOption and remove
+ the element which had been backing that MenuList from the document.
+ Adding null checks prior to the assertions prevents our crashing if the
+ parent or grandparent was removed.
+
+ Test: platform/gtk/accessibility/combobox-descendants-orientation-crash.html
+
+ * accessibility/AccessibilityMenuListOption.cpp:
+ (WebCore::AccessibilityMenuListOption::elementRect):
+
2014-11-16 Chris Dumez <[email protected]>
Assertion hit when setting a very large value to 'border-width' / 'font-size' CSS properties
Modified: releases/WebKitGTK/webkit-2.6/Source/WebCore/accessibility/AccessibilityMenuListOption.cpp (176388 => 176389)
--- releases/WebKitGTK/webkit-2.6/Source/WebCore/accessibility/AccessibilityMenuListOption.cpp 2014-11-20 08:43:25 UTC (rev 176388)
+++ releases/WebKitGTK/webkit-2.6/Source/WebCore/accessibility/AccessibilityMenuListOption.cpp 2014-11-20 09:04:24 UTC (rev 176389)
@@ -104,9 +104,13 @@
LayoutRect AccessibilityMenuListOption::elementRect() const
{
AccessibilityObject* parent = parentObject();
+ if (!parent)
+ return boundingBoxRect();
ASSERT(parent->isMenuListPopup());
AccessibilityObject* grandparent = parent->parentObject();
+ if (!grandparent)
+ return boundingBoxRect();
ASSERT(grandparent->isMenuList());
return grandparent->elementRect();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
