Bug 230828

Summary: Boundary check of AccessibilityMathMLElement::mathOverObject is incorrect
Product: WebKit Reporter: Frédéric Wang (:fredw) <fred.wang>
Component: AccessibilityAssignee: Andres Gonzalez <andresg_22>
Severity: Normal CC: aboxhall, andresg_22, apinheiro, cfleizach, dmazzoni, ews-watchlist, jcraig, jdiggs, samuel_white, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
Patch none

Description Frédéric Wang (:fredw) 2021-09-27 06:49:07 PDT
For an munderover tag, we try to access children[2] but only check whether there are at least 2 children.
Comment 1 Radar WebKit Bug Importer 2021-09-27 06:49:19 PDT
Comment 2 Andres Gonzalez 2021-09-27 08:21:41 PDT
Created attachment 439355 [details]
Comment 3 EWS 2021-09-27 10:59:54 PDT
Committed r283127 (242185@main): <https://commits.webkit.org/242185@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 439355 [details].