230828 2021-09-27 06:49:07 -0700 Boundary check of AccessibilityMathMLElement::mathOverObject is incorrect 2021-09-27 10:59:56 -0700 1 1 1 Unclassified WebKit Accessibility WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 fred.wang andresg_22 aboxhall andresg_22 apinheiro cfleizach dmazzoni ews-watchlist jcraig jdiggs samuel_white webkit-bug-importer oldest_to_newest 1797438 0 fred.wang 2021-09-27 06:49:07 -0700 For an munderover tag, we try to access children[2] but only check whether there are at least 2 children. 1797439 1 webkit-bug-importer 2021-09-27 06:49:19 -0700 <rdar://problem/83571752> 1797469 2 439355 andresg_22 2021-09-27 08:21:41 -0700 Created attachment 439355 Patch 1797567 3 ews-feeder 2021-09-27 10:59:54 -0700 Committed r283127 (242185@main): <https://commits.webkit.org/242185@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 439355. 439355 2021-09-27 08:21:41 -0700 2021-09-27 10:59:55 -0700 Patch bug-230828-20210927112140.patch text/plain 1738 andresg_22 U3VidmVyc2lvbiBSZXZpc2lvbjogMjgyOTU4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzM2ZWRjODc4ODAyZjE5 Mzk2ZmVlNzc3NzM5ODAzYmFkZGU5ZjYwMi4uMmQ1MWIzZWNkNDFmMjc4NzcxYjQ3OTU4OGFlMjUx MDY3MWExNjVjNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDIxLTA5LTI3ICBBbmRy ZXMgR29uemFsZXogIDxhbmRyZXNnXzIyQGFwcGxlLmNvbT4KKworICAgICAgICBCb3VuZGFyeSBj aGVjayBvZiBBY2Nlc3NpYmlsaXR5TWF0aE1MRWxlbWVudDo6bWF0aE92ZXJPYmplY3QgaXMgaW5j b3JyZWN0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0y MzA4MjgKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzgzNTcxNzUyPgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogYWNjZXNzaWJpbGl0eS9BY2Nlc3Np YmlsaXR5TWF0aE1MRWxlbWVudC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpBY2Nlc3NpYmlsaXR5 TWF0aE1MRWxlbWVudDo6bWF0aE92ZXJPYmplY3QpOgorCiAyMDIxLTA5LTIzICBBbmRyZXMgR29u emFsZXogIDxhbmRyZXNnXzIyQGFwcGxlLmNvbT4KIAogICAgICAgICBSZW1vdmUgQVhEUlRFbGVt ZW50SWRBdHRyaWJ1dGUgZnJvbSB0aGUgQVggb2JqZWN0IHBsYXRmb3JtIHdyYXBwZXIgaW50ZXJm YWNlLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmls aXR5TWF0aE1MRWxlbWVudC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vz c2liaWxpdHlNYXRoTUxFbGVtZW50LmNwcAppbmRleCBhYWVhZmUwODRjOGU3ZGJiYzllNmQ2MGY1 NmE2MzM3YjUyZDFkZGFiLi5iZDVmYjk3ZDNmZjAyNzQ3NDY4YjRkNmMxMmI1ZGJhYzU3MGVmN2Rl IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlN YXRoTUxFbGVtZW50LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vz c2liaWxpdHlNYXRoTUxFbGVtZW50LmNwcApAQCAtMzA3LDEyICszMDcsMTEgQEAgQVhDb3JlT2Jq ZWN0KiBBY2Nlc3NpYmlsaXR5TWF0aE1MRWxlbWVudDo6bWF0aE92ZXJPYmplY3QoKQogICAgICAg ICByZXR1cm4gbnVsbHB0cjsKIAogICAgIGNvbnN0IGF1dG8mIGNoaWxkcmVuID0gdGhpcy0+Y2hp bGRyZW4oKTsKLSAgICBpZiAoY2hpbGRyZW4uc2l6ZSgpIDwgMikKLSAgICAgICAgcmV0dXJuIG51 bGxwdHI7CiAKLSAgICBpZiAobm9kZSgpLT5oYXNUYWdOYW1lKE1hdGhNTE5hbWVzOjptb3ZlclRh ZykpCisgICAgaWYgKGNoaWxkcmVuLnNpemUoKSA+PSAyICYmIG5vZGUoKS0+aGFzVGFnTmFtZShN YXRoTUxOYW1lczo6bW92ZXJUYWcpKQogICAgICAgICByZXR1cm4gY2hpbGRyZW5bMV0uZ2V0KCk7 Ci0gICAgaWYgKG5vZGUoKS0+aGFzVGFnTmFtZShNYXRoTUxOYW1lczo6bXVuZGVyb3ZlclRhZykp CisKKyAgICBpZiAoY2hpbGRyZW4uc2l6ZSgpID49IDMgJiYgbm9kZSgpLT5oYXNUYWdOYW1lKE1h dGhNTE5hbWVzOjptdW5kZXJvdmVyVGFnKSkKICAgICAgICAgcmV0dXJuIGNoaWxkcmVuWzJdLmdl dCgpOwogCiAgICAgcmV0dXJuIG51bGxwdHI7Cg==