Attachment 342755 Details for Bug 186629 – patch

[patch] patch

patch.txt (text/plain), 4.35 KB, created by Nan Wang on 2018-06-14 12:56:32 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Nan Wang

Created: 2018-06-14 12:56:32 PDT

Size: 4.35 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 232847)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,18 @@
>+2018-06-14  Nan Wang  <n_wang@apple.com>
>+
>+        AX: Crash in AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 536
>+        https://bugs.webkit.org/show_bug.cgi?id=186629
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This crashed when we passed a null node to ancestorsOfType. Fixed it
>+        by adding a null check.
>+
>+        Test: accessibility/hidden-object-text-value-crash.html
>+
>+        * accessibility/AccessibilityNodeObject.cpp:
>+        (WebCore::AccessibilityNodeObject::textUnderElement const):
>+
> 2018-06-14  Timothy Hatcher  <timothy@apple.com>
> 
>         Expose more semantic system colors.
>Index: Source/WebCore/accessibility/AccessibilityNodeObject.cpp
>===================================================================
>--- Source/WebCore/accessibility/AccessibilityNodeObject.cpp	(revision 232774)
>+++ Source/WebCore/accessibility/AccessibilityNodeObject.cpp	(working copy)
>@@ -1744,7 +1744,7 @@ String AccessibilityNodeObject::textUnde
>     // The Accname specification states that if the current node is hidden, and not directly
>     // referenced by aria-labelledby or aria-describedby, and is not a host language text
>     // alternative, the empty string should be returned.
>-    if (isHidden() && !is<HTMLLabelElement>(node) && !ancestorsOfType<HTMLCanvasElement>(*node).first()) {
>+    if (isHidden() && !is<HTMLLabelElement>(node) && (node && !ancestorsOfType<HTMLCanvasElement>(*node).first())) {
>         AccessibilityObject::AccessibilityChildrenVector labelFor;
>         AccessibilityObject::AccessibilityChildrenVector descriptionFor;
>         ariaLabelledByReferencingElements(labelFor);
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 232774)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-06-14  Nan Wang  <n_wang@apple.com>
>+
>+        AX: Crash in AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 536
>+        https://bugs.webkit.org/show_bug.cgi?id=186629
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * accessibility/hidden-object-text-value-crash-expected.txt: Added.
>+        * accessibility/hidden-object-text-value-crash.html: Added.
>+
> 2018-06-12  Zalan Bujtas  <zalan@apple.com>
> 
>         Complex text handling should opt out of bounded text layout.
>Index: LayoutTests/accessibility/hidden-object-text-value-crash-expected.txt
>===================================================================
>--- LayoutTests/accessibility/hidden-object-text-value-crash-expected.txt	(nonexistent)
>+++ LayoutTests/accessibility/hidden-object-text-value-crash-expected.txt	(working copy)
>@@ -0,0 +1,13 @@
>+
>+click
>+Description text
>+
>+This tests that it won't cause a crash when computing the text value of an AX object that is hidden and has no node.
>+
>+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>+
>+
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>Index: LayoutTests/accessibility/hidden-object-text-value-crash.html
>===================================================================
>--- LayoutTests/accessibility/hidden-object-text-value-crash.html	(nonexistent)
>+++ LayoutTests/accessibility/hidden-object-text-value-crash.html	(working copy)
>@@ -0,0 +1,39 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<script src="../resources/js-test-pre.js"></script>
>+</head>
>+<style>
>+span::before {
>+    content: "Before";
>+}
>+</style>
>+<body id="body">
>+
>+<button id="button" type="button" aria-hidden="true" aria-haspopup="true"><span></span></button>
>+<div id="button2" aria-labelledby="button">
>+<button>click</button>
>+</div>
>+
>+<p>Description text</p>
>+</div>
>+
>+<p id="description"></p>
>+<div id="console"></div>
>+
>+<script>
>+
>+    description("This tests that it won't cause a crash when computing the text value of an AX object that is hidden and has no node.");
>+
>+    if (window.accessibilityController) {
>+
>+        var button = accessibilityController.accessibleElementById("button2");
>+        // Do not crash
>+        button.description;
>+    }
>+
>+</script>
>+
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 186629: 342755