Bug 208867 – Crash in RenderMenuList::didUpdateActiveOption.

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Andres Gonzalez]

Crash in RenderMenuList::didUpdateActiveOption.

[Andres Gonzalez]

Created attachment 393162 [details]
Patch

[Andres Gonzalez]

<rdar://problem/60035390>

[chris fleizach]

Comment on attachment 393162 [details]
Patch

Can we add a test?

[Sam Weinig]

Comment on attachment 393162 [details]
Patch

Needs a test.

[Darin Adler]

Comment on attachment 393162 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=393162&action=review

> Source/WebCore/rendering/RenderMenuList.cpp:428
> -    if (auto* menuList = downcast<AccessibilityMenuList>(axCache->get(this)))
> -        menuList->didUpdateActiveOption(optionIndex);
> +    if (auto* axObject = axCache->get(this)) {
> +        if (!is<AccessibilityMenuList>(*axObject))
> +            return;
> +
> +        downcast<AccessibilityMenuList>(*axObject).didUpdateActiveOption(optionIndex);
> +    }

More elegant way to write this taking advantage of the null checking built into is<>:

    auto* axObject = axCache->get(this);
    if (is<AccessibiltyMenuList>(axObject))
        downcast<AccessibilityMenuList>(*axObject).didUpdateActiveOption(optionIndex);

[Andres Gonzalez]

Created attachment 395303 [details]
Patch

[Andres Gonzalez]

(In reply to Darin Adler from comment #5)
> Comment on attachment 393162 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=393162&action=review
> 
> > Source/WebCore/rendering/RenderMenuList.cpp:428
> > -    if (auto* menuList = downcast<AccessibilityMenuList>(axCache->get(this)))
> > -        menuList->didUpdateActiveOption(optionIndex);
> > +    if (auto* axObject = axCache->get(this)) {
> > +        if (!is<AccessibilityMenuList>(*axObject))
> > +            return;
> > +
> > +        downcast<AccessibilityMenuList>(*axObject).didUpdateActiveOption(optionIndex);
> > +    }
> 
> More elegant way to write this taking advantage of the null checking built
> into is<>:
> 
>     auto* axObject = axCache->get(this);
>     if (is<AccessibiltyMenuList>(axObject))
>        
> downcast<AccessibilityMenuList>(*axObject).
> didUpdateActiveOption(optionIndex);

Done. Thanks!

[Andres Gonzalez]

Created attachment 395319 [details]
Patch

[EWS]

Committed r259438: <https://trac.webkit.org/changeset/259438>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 395319 [details].