Commit 167dff30 authored by's avatar

Bug 23385: crash at • WebCore::HTMLAnchorElement::isKeyboardFocusable

Option-tabbing on page with image map links causes crash

git-svn-id: 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent e12c2d37
2009-01-16 Chris Fleizach <>
Reviewed by Darin Adler.
Test case for
Bug 23385: crash at WebCore::HTMLAnchorElement::isKeyboardFocusable
* fast/events/tab-crash-with-image-map-expected.txt: Added.
* fast/events/tab-crash-with-image-map.html: Added.
2009-01-15 Chris Marrin <>
Reviewed by Sam Weinig.
Test passes if there is no crash
Google (tabindex 5)
Yahoo (tabindex 2)
Google (tabindex 4)
Yahoo (tabindex 6)
function dispatchTabPress(element, shiftKey)
var event = document.createEvent('KeyboardEvents');
var tabKeyIdentifier = 'U+0009';
event.initKeyboardEvent('keydown', true, true, document.defaultView, tabKeyIdentifier, 0, false, true, shiftKey, false, false);
function test()
if (window.layoutTestController) {
for (var i = 0; i < 40; ++i) {
dispatchTabPress(document, false);
<body onload="test()">
Test passes if there is no crash
<p><a tabindex="5" id="link1" href="">Google (tabindex 5)</a></p>
<p><a tabindex="2" href="">Yahoo (tabindex 2)</a></p>
<p><img src="resources/cake.png" usemap="#firstmap" alt=
"This is a alt text" style="border: 0px none;">
<map name="firstmap" title="map" id="firstmap">
<area shape="rect" id="upper_left" tabindex="3" coords="12,15,82,86" href=
"up_left.htm" title="upper left" alt="Blue rectangle">
<area shape="rect" id="middle_middle" tabindex="7" coords="122,103,191,172"
href="mid_mid.htm" title="middle middle" alt="Blue rectangle">
<area shape="rect" id="lower_middle" coords="121,192,192,261"
href="low_mid.htm" alt="Blue rectangle">
<area shape="circle" id="upper_middle" coords="157,52,33" href=
"up_mid.htm" alt="Red circle">
<area shape="circle" id="middle_left" tabindex="1" coords="47,135,33" href=
"mid_left.htm" alt="Red circle">
<area shape="circle" id="lower_right" coords="259,227,34" href=
"low_rt.htm" alt="Red circle">
<area shape="poly" id="lower_left" coords=
"57,198,23,221,23,241,58,265,93,241,93,221" href="low_left.htm" alt="Yellow hexagon">
<area shape="poly" id="middle_right" coords=
"264,106,232,127,230,148,264,171,298,148,298,126" href="mid_rt.htm" alt="Yellow hexagon">
<area shape="poly" id="upper_right" coords=
"261,18,226,41,226,59,263,85,295,59,296,38" href="up_rt.htm" alt="Yellow hexagon">
<area shape="poly" id="left_brown" coords=
href="left_brn.htm" alt="Brown polygon">
<area shape="poly" id="top_brown" coords="94,4,105,22,166,11,164,5" href=
"top_brn.htm" alt="Brown polygon">
<area shape="poly" id="right_brown" coords=
href="rt_brn.htm" alt="Brown polygon">
<area shape="default" href="default.htm" alt="foo">
<p><a href="" tabindex="4">Google (tabindex 4)</a></p>
<p><a href="" tabindex="6">Yahoo (tabindex 6)</a></p>
2009-01-16 Chris Fleizach <>
Reviewed by Darin Adler.
Bug 23385: crash at WebCore::HTMLAnchorElement::isKeyboardFocusable
Option-tabbing through the page mentioned in the bug causes a crash
Test: fast/events/tab-crash-with-image-map.html
* html/HTMLAnchorElement.cpp:
2009-01-16 Thiago Macieira <>
Reviewed by Simon Hausmann.
......@@ -107,6 +107,9 @@ bool HTMLAnchorElement::isKeyboardFocusable(KeyboardEvent* event) const
if (!document()->frame()->eventHandler()->tabsToLinks(event))
return false;
if (!renderer())
return false;
// Before calling absoluteRects, check for the common case where the renderer
// or one of the continuations is non-empty, since this is a faster check and
// almost always returns true.
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment