Title: [184097] trunk
- Revision
- 184097
- Author
- [email protected]
- Date
- 2015-05-11 08:08:00 -0700 (Mon, 11 May 2015)
Log Message
AX: Crash at WebCore::AccessibilityMenuList::addChildren()
https://bugs.webkit.org/show_bug.cgi?id=144860
Reviewed by Mario Sanchez Prada.
Source/WebCore:
There were some unsafe pointer accesses in AccessibilityMenuList code that needed to be cleaned up.
Test: accessibility/menu-list-crash2.html
* accessibility/AccessibilityMenuList.cpp:
(WebCore::AccessibilityMenuList::addChildren):
LayoutTests:
* accessibility/menu-list-crash2-expected.txt: Added.
* accessibility/menu-list-crash2.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (184096 => 184097)
--- trunk/LayoutTests/ChangeLog 2015-05-11 14:00:44 UTC (rev 184096)
+++ trunk/LayoutTests/ChangeLog 2015-05-11 15:08:00 UTC (rev 184097)
@@ -1,3 +1,13 @@
+2015-05-11 Chris Fleizach <[email protected]>
+
+ AX: Crash at WebCore::AccessibilityMenuList::addChildren()
+ https://bugs.webkit.org/show_bug.cgi?id=144860
+
+ Reviewed by Mario Sanchez Prada.
+
+ * accessibility/menu-list-crash2-expected.txt: Added.
+ * accessibility/menu-list-crash2.html: Added.
+
2015-05-11 Marcos ChavarrÃa Teijeiro <[email protected]>
[GTK] Gardening 7th May.
Added: trunk/LayoutTests/accessibility/menu-list-crash2-expected.txt (0 => 184097)
--- trunk/LayoutTests/accessibility/menu-list-crash2-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/menu-list-crash2-expected.txt 2015-05-11 15:08:00 UTC (rev 184097)
@@ -0,0 +1,13 @@
+TEST
+TEST
+This tests that there's no crash if we hide menu list and then try to access accessibility information.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Role before removal: AXRole: AXPopUpButton
+Role after removal: AXRole:
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/menu-list-crash2.html (0 => 184097)
--- trunk/LayoutTests/accessibility/menu-list-crash2.html (rev 0)
+++ trunk/LayoutTests/accessibility/menu-list-crash2.html 2015-05-11 15:08:00 UTC (rev 184097)
@@ -0,0 +1,48 @@
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+TEST
+<div id="content">
+
+<select id="menulist">
+ <option selected>One</option>
+ <option>Two</option>
+ <option>Three</option>
+</select>
+
+</div>
+TEST
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+function runTest() {
+ description("This tests that there's no crash if we hide menu list and then try to access accessibility information.");
+
+ if (window.accessibilityController) {
+ var menulist = document.getElementById("menulist");
+ menulist.focus();
+ menulist.selectedIndex = 1;
+
+ var accessibleMenulist = accessibilityController.focusedElement;
+ debug("Role before removal: " + accessibleMenulist.role);
+
+ menulist.style.display = "none";
+ gc();
+
+ // Don't crash!
+ debug("Role after removal: " + accessibleMenulist.role);
+ }
+}
+
+runTest();
+</script>
+
+</body>
+<script src=""
+</html>
Modified: trunk/Source/WebCore/ChangeLog (184096 => 184097)
--- trunk/Source/WebCore/ChangeLog 2015-05-11 14:00:44 UTC (rev 184096)
+++ trunk/Source/WebCore/ChangeLog 2015-05-11 15:08:00 UTC (rev 184097)
@@ -1,3 +1,17 @@
+2015-05-11 Chris Fleizach <[email protected]>
+
+ AX: Crash at WebCore::AccessibilityMenuList::addChildren()
+ https://bugs.webkit.org/show_bug.cgi?id=144860
+
+ Reviewed by Mario Sanchez Prada.
+
+ There were some unsafe pointer accesses in AccessibilityMenuList code that needed to be cleaned up.
+
+ Test: accessibility/menu-list-crash2.html
+
+ * accessibility/AccessibilityMenuList.cpp:
+ (WebCore::AccessibilityMenuList::addChildren):
+
2015-05-11 Przemyslaw Szymanski <[email protected]>
[WebGL] Unnecessary condition check in the while loop
Modified: trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp (184096 => 184097)
--- trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2015-05-11 14:00:44 UTC (rev 184096)
+++ trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2015-05-11 15:08:00 UTC (rev 184097)
@@ -58,10 +58,13 @@
void AccessibilityMenuList::addChildren()
{
- m_haveChildren = true;
-
- AXObjectCache* cache = m_renderer->document().axObjectCache();
-
+ if (!m_renderer)
+ return;
+
+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return;
+
AccessibilityObject* list = cache->getOrCreate(MenuListPopupRole);
if (!list)
return;
@@ -72,6 +75,7 @@
return;
}
+ m_haveChildren = true;
m_children.append(list);
list->addChildren();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
