Commit 167dff30 authored by cfleizach@apple.com's avatar cfleizach@apple.com

Bug 23385: crash at com.apple.WebCore • WebCore::HTMLAnchorElement::isKeyboardFocusable

https://bugs.webkit.org/show_bug.cgi?id=23385

Option-tabbing on page with image map links causes crash



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@39973 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent e12c2d37
2009-01-16 Chris Fleizach <cfleizach@apple.com>
Reviewed by Darin Adler.
Test case for
Bug 23385: crash at com.apple.WebCore WebCore::HTMLAnchorElement::isKeyboardFocusable
* fast/events/tab-crash-with-image-map-expected.txt: Added.
* fast/events/tab-crash-with-image-map.html: Added.
2009-01-15 Chris Marrin <cmarrin@apple.com>
Reviewed by Sam Weinig.
......
Test passes if there is no crash
Google (tabindex 5)
Yahoo (tabindex 2)
Google (tabindex 4)
Yahoo (tabindex 6)
<html>
<head>
<script>
function dispatchTabPress(element, shiftKey)
{
var event = document.createEvent('KeyboardEvents');
var tabKeyIdentifier = 'U+0009';
event.initKeyboardEvent('keydown', true, true, document.defaultView, tabKeyIdentifier, 0, false, true, shiftKey, false, false);
element.dispatchEvent(event);
}
function test()
{
if (window.layoutTestController) {
layoutTestController.dumpAsText();
}
document.getElementById("link1").focus();
for (var i = 0; i < 40; ++i) {
dispatchTabPress(document, false);
}
}
</script>
</head>
<body onload="test()">
Test passes if there is no crash
<p><a tabindex="5" id="link1" href="http://www.google.com/">Google (tabindex 5)</a></p>
<p><a tabindex="2" href="http://www.yahoo.com/">Yahoo (tabindex 2)</a></p>
<p><img src="resources/cake.png" usemap="#firstmap" alt=
"This is a alt text" style="border: 0px none;">
<map name="firstmap" title="map" id="firstmap">
<area shape="rect" id="upper_left" tabindex="3" coords="12,15,82,86" href=
"up_left.htm" title="upper left" alt="Blue rectangle">
<area shape="rect" id="middle_middle" tabindex="7" coords="122,103,191,172"
href="mid_mid.htm" title="middle middle" alt="Blue rectangle">
<area shape="rect" id="lower_middle" coords="121,192,192,261"
href="low_mid.htm" alt="Blue rectangle">
<area shape="circle" id="upper_middle" coords="157,52,33" href=
"up_mid.htm" alt="Red circle">
<area shape="circle" id="middle_left" tabindex="1" coords="47,135,33" href=
"mid_left.htm" alt="Red circle">
<area shape="circle" id="lower_right" coords="259,227,34" href=
"low_rt.htm" alt="Red circle">
<area shape="poly" id="lower_left" coords=
"57,198,23,221,23,241,58,265,93,241,93,221" href="low_left.htm" alt="Yellow hexagon">
<area shape="poly" id="middle_right" coords=
"264,106,232,127,230,148,264,171,298,148,298,126" href="mid_rt.htm" alt="Yellow hexagon">
<area shape="poly" id="upper_right" coords=
"261,18,226,41,226,59,263,85,295,59,296,38" href="up_rt.htm" alt="Yellow hexagon">
<area shape="poly" id="left_brown" coords=
"89,8,89,156,5,193,9,223,63,190,97,214,97,246,62,274,109,275,109,98,140,97"
href="left_brn.htm" alt="Brown polygon">
<area shape="poly" id="top_brown" coords="94,4,105,22,166,11,164,5" href=
"top_brn.htm" alt="Brown polygon">
<area shape="poly" id="right_brown" coords=
"168,5,169,11,194,33,194,257,265,283,265,270,220,247,220,200,255,179,227,158,227,123,265,98,221,68,220,36,269,6"
href="rt_brn.htm" alt="Brown polygon">
<area shape="default" href="default.htm" alt="foo">
</map></p>
<p><a href="http://www.google.com/" tabindex="4">Google (tabindex 4)</a></p>
<p><a href="http://www.yahoo.com/" tabindex="6">Yahoo (tabindex 6)</a></p>
</body>
</html>
2009-01-16 Chris Fleizach <cfleizach@apple.com>
Reviewed by Darin Adler.
Bug 23385: crash at com.apple.WebCore WebCore::HTMLAnchorElement::isKeyboardFocusable
https://bugs.webkit.org/show_bug.cgi?id=23385
Option-tabbing through the page mentioned in the bug causes a crash
Test: fast/events/tab-crash-with-image-map.html
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::isKeyboardFocusable):
2009-01-16 Thiago Macieira <thiago.macieira@nokia.com>
Reviewed by Simon Hausmann.
......@@ -107,6 +107,9 @@ bool HTMLAnchorElement::isKeyboardFocusable(KeyboardEvent* event) const
if (!document()->frame()->eventHandler()->tabsToLinks(event))
return false;
if (!renderer())
return false;
// Before calling absoluteRects, check for the common case where the renderer
// or one of the continuations is non-empty, since this is a faster check and
// almost always returns true.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment