Attachment 456291 Details for Bug 238635 – Patch

[patch] Patch

bug-238635-20220331172340.patch (text/plain), 2.62 KB, created by Tyler Wilcock on 2022-03-31 15:23:41 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Tyler Wilcock

Created: 2022-03-31 15:23:41 PDT

Size: 2.62 KB

patch

obsolete

>Subversion Revision: 292105
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index aa206433f6e6448c5138f1cd0481646545e454b9..47464344755c8fca2978202c46374b4b305c6599 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,27 @@
>+2022-03-31  Tyler Wilcock  <tyler_w@apple.com>
>+
>+        -[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:] should fail fast if the given parameter wrapper has no backing object
>+        https://bugs.webkit.org/show_bug.cgi?id=238635
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        If this method is called with a parameter wrapper object that has lost
>+        its backing object, we should return early to avoid dereferencing a
>+        null pointer.
>+
>+        This could happen in rare split-second transition states where a wrapper
>+        has lost its backing object but has not yet been cleaned up by a notification.
>+        This could also happen if WebKit is vending detached objects (e.g. via AXChildren)
>+        in a similar transition state.
>+
>+        No test added because I haven't been able to find any scenario reproducing
>+        this issue either in our existing layout tests or on real webpages.
>+
>+        rdar://90925399
>+
>+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
>+        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
>+
> 2022-03-30  Youenn Fablet  <youenn@apple.com>
> 
>         Implement ServiceWorker WindowClient.ancestorOrigins
>diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
>index ee99006291d318d5293acc9448d0578061a4e547..c33252dad335ff3ac6887f2dc19a4a575459926e 100644
>--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
>+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
>@@ -3500,8 +3500,12 @@ ALLOW_DEPRECATED_IMPLEMENTATIONS_END
>         textMarker = (AXTextMarkerRef)parameter;
>     else if (AXObjectIsTextMarkerRange(parameter))
>         textMarkerRange = (AXTextMarkerRangeRef)parameter;
>-    else if ([parameter isKindOfClass:[WebAccessibilityObjectWrapper class]])
>+    else if ([parameter isKindOfClass:[WebAccessibilityObjectWrapper class]]) {
>         uiElement = [(WebAccessibilityObjectWrapper*)parameter axBackingObject];
>+        // The parameter wrapper object has lost its AX object since being given to the client, so bail early.
>+        if (!uiElement)
>+            return nil;
>+    }
>     else if ([parameter isKindOfClass:[NSNumber class]])
>         number = parameter;
>     else if ([parameter isKindOfClass:[NSArray class]])

Actions: View | Formatted Diff | Diff

Attachments on bug 238635: 456286 | 456288 | 456291