Bug 67722 (CVE-2012-3681)

Summary: Changes to aria-hidden don't change VO navigation
Product: WebKit Reporter: chris fleizach <cfleizach>
Component: AccessibilityAssignee: chris fleizach <cfleizach>
Status: RESOLVED FIXED    
Severity: Normal CC: ayao
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch darin: review+

chris fleizach
Reported 2011-09-07 11:45:44 PDT
Using JS to update aria-hidden attributes doesn't appear to change the VO navigation. For example, toggling the attribute (or lack thereof) on a list of items doesn't change the item that gets read when navigating the list.
Attachments
patch (7.83 KB, patch)
2011-09-07 11:53 PDT, chris fleizach 		darin: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
chris fleizach
Comment 1 2011-09-07 11:45:51 PDT
rdar://9973225
chris fleizach
Comment 2 2011-09-07 11:53:44 PDT
Created attachment 106616 [details] patch
chris fleizach
Comment 3 2011-09-07 11:55:07 PDT
Looks like the problem was when a parent asked for it's children, the children may not have been told to re-update their own caches. The result was that stale children information might be propagated. The fix is to always clear the children first. This ensures the parent always has the most up to date information
Darin Adler
Comment 4 2011-09-07 13:51:04 PDT
Comment on attachment 106616 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=106616&action=review > Source/WebCore/accessibility/AccessibilityRenderObject.cpp:3461 > + // or its visiblity has changed. In the latter case, this child may have a stale child cached. Typo: visibillity
chris fleizach
Comment 5 2011-09-07 14:41:21 PDT
http://trac.webkit.org/changeset/94716
Note You need to log in before you can comment on or make changes to this bug.