Bug 65174 – Accessibility stack exhaustion using role attribute

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[Berend-Jan Wever]

Created attachment 101987 [details]
Repro

Repro:
<label><q role=x><input>

This causes a loop where AccessibilityRenderObjects create more AccessibilityRenderObjects until all stack space has been used and the thread is terminated.

This requires you to enable accessibility to reproduce.

[Berend-Jan Wever]

Chromium: https://code.google.com/p/chromium/issues/detail?id=90497

[chris fleizach]

#16568 0x00000001028226ef in WebCore::AXObjectCache::getOrCreate (this=0x130276230, renderer=0x12a494dc8) at AXObjectCache.cpp:285
#16569 0x0000000102835d22 in WebCore::AccessibilityRenderObject::parentObject (this=0x1001cbe80) at AccessibilityRenderObject.cpp:443
#16570 0x000000010283bf26 in WebCore::AccessibilityRenderObject::ariaIsHidden (this=0x1001cbe80) at AccessibilityRenderObject.cpp:1702
#16571 0x0000000102828d97 in WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase (this=0x1001cbe80) at AccessibilityRenderObject.cpp:1753
#16572 0x000000010283c12f in WebCore::AccessibilityRenderObject::accessibilityIsIgnored (this=0x1001cbe80) at AccessibilityRenderObject.cpp:1775
#16573 0x000000010283bcde in WebCore::AccessibilityRenderObject::exposesTitleUIElement (this=0x1001cbe80) at AccessibilityRenderObject.cpp:1663
#16574 0x000000010283c2f9 in WebCore::AccessibilityRenderObject::accessibilityIsIgnored (this=0x1001cbb40) at AccessibilityRenderObject.cpp:1808
#16575 0x000000010282da10 in WebCore::AccessibilityObject::parentObjectUnignored (this=0x13391aab0) at AccessibilityObject.cpp:316
#16576 0x0000000102842cd6 in WebCore::AccessibilityRenderObject::determineAriaRoleAttribute (this=0x13391aab0) at AccessibilityRenderObject.cpp:3005
#16577 0x0000000102834517 in WebCore::AccessibilityRenderObject::determineAccessibilityRole (this=0x13391aab0) at AccessibilityRenderObject.cpp:3049
#16578 0x0000000102828a6d in WebCore::AccessibilityRenderObject::AccessibilityRenderObject (this=0x13391aab0, renderer=0x12a494dc8) at AccessibilityRenderObject.cpp:98
#16579 0x00000001028344cd in WebCore::AccessibilityRenderObject::AccessibilityRenderObject (this=0x13391aab0, renderer=0x12a494dc8) at AccessibilityRenderObject.cpp:97
#16580 0x0000000102834bce in WebCore::AccessibilityRenderObject::create (renderer=0x12a494dc8) at AccessibilityRenderObject.cpp:112
#16581 0x0000000102823ffd in createFromRenderer (renderer=0x12a494dc8) at AXObjectCache.cpp:250
#16582 0x00000001028226ef in WebCore::AXObjectCache::getOrCreate (this=0x130276230, renderer=0x12a494dc8) at AXObjectCache.cpp:285

[chris fleizach]

rdar://9923054

[chris fleizach]

Created attachment 103381 [details]
patch

[WebKit Review Bot]

Attachment 103381 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/acce..." exit_code: 1

Source/WebCore/accessibility/AccessibilityRenderObject.cpp:3003:  An else if statement should be written as an if statement when the prior "if" concludes with a return, break, continue or goto statement.  [readability/control_flow] [4]
Total errors found: 1 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[chris fleizach]

FYI i will fix the style error on commit

[Darin Adler]

Comment on attachment 103381 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=103381&action=review

> Source/WebCore/accessibility/AccessibilityRenderObject.cpp:2999
> +    AccessibilityObject* parent;
> +    for (parent = parentObject(); parent && !parent->accessibilityIsIgnored(); parent = parent->parentObject()) {

I’d suggest defining this inside the for statement.

> Source/WebCore/accessibility/AccessibilityRenderObject.cpp:3006
> +        if (role == ListBoxOptionRole && parentAriaRole == MenuRole)
> +            return MenuItemRole;
> +        // An aria "menuitem" may map to MenuButton or MenuItem depending on its parent.
> +        else if (role == MenuItemRole && parentAriaRole == GroupRole)

Yes, no need for else.

[chris fleizach]

http://trac.webkit.org/changeset/93243

[chris fleizach]

http://trac.webkit.org/changeset/93246