Source/WebCore: AX: Images within anchors causes crash

https://bugs.webkit.org/show_bug.cgi?id=44149

Patch by Dominic Mazzoni <dmazzoni@google.com> on 2011-09-09
Reviewed by Chris Fleizach.

Fixes the way parent RenderObject of an AccessibilityRenderObject
is computed in the presence of adjacent continuations.

Test: accessibility/div-within-anchors-causes-crash.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::renderParentObject):

LayoutTests: Add a test to catch a case where an assertion failure or
crash is triggered in AccessibilityRenderObject when deleting
a node that includes a continuation.
https://bugs.webkit.org/show_bug.cgi?id=44149

Patch by Dominic Mazzoni <dmazzoni@google.com> on 2011-09-09
Reviewed by Chris Fleizach.

* accessibility/div-within-anchors-causes-crash.html: Added.
* platform/mac/accessibility/div-within-anchors-causes-crash-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@94888 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 01754773
2011-09-09 Dominic Mazzoni <dmazzoni@google.com>
Add a test to catch a case where an assertion failure or
crash is triggered in AccessibilityRenderObject when deleting
a node that includes a continuation.
https://bugs.webkit.org/show_bug.cgi?id=44149
Reviewed by Chris Fleizach.
* accessibility/div-within-anchors-causes-crash.html: Added.
* platform/mac/accessibility/div-within-anchors-causes-crash-expected.txt: Added.
2011-09-09 Kulanthaivel Palanichamy <kulanthaivel@codeaurora.org>
CSS rules not being applied when a hidden field is inserted between an input[type=checkbox] and a label
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
<script>
var successfullyParsed = false;
function buildAccessibilityTree(accessibilityObject, indent) {
var str = "";
for (var i = 0; i < indent; i++)
str += " ";
str += accessibilityObject.role;
str += " " + accessibilityObject.stringValue;
str += "\n";
document.getElementById("tree").innerText += str;
if (accessibilityObject.stringValue.indexOf('End of test') >= 0)
return false;
var count = accessibilityObject.childrenCount;
for (var i = 0; i < count; ++i) {
if (!buildAccessibilityTree(accessibilityObject.childAtIndex(i), indent + 1))
return false;
}
return true;
}
</script>
<script src="../fast/js/resources/js-test-pre.js"></script>
</head>
<body>
<a><div></div></a>
<a><div></div></a>
<a href="about:blank"><div></div></a>
<div>End of test</div>
<pre id="tree"></pre>
<p id="description"></p>
<div id="console"></div>
<script>
description("This can cause a crash.");
if (window.accessibilityController) {
// First build up full accessibility tree.
document.getElementById("tree").innerText += "Before:\n";
document.body.focus();
buildAccessibilityTree(accessibilityController.focusedElement, 0);
// Remove anchor that causes debug assert in AccessibilityRenderObject::addChildren
document.body.removeChild(document.body.children[2])
// Build up full accessibility tree again.
document.getElementById("tree").innerText += "After:\n";
document.body.focus();
buildAccessibilityTree(accessibilityController.focusedElement, 0);
}
successfullyParsed = true;
</script>
<script src="../fast/js/resources/js-test-post.js"></script>
</body>
</html>
End of test
Before:
AXRole: AXWebArea AXValue:
AXRole: AXLink AXValue:
AXRole: AXGroup AXValue:
AXRole: AXStaticText AXValue: End of test
After:
AXRole: AXWebArea AXValue:
AXRole: AXGroup AXValue:
AXRole: AXStaticText AXValue: End of test
This can cause a crash.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS successfullyParsed is true
TEST COMPLETE
2011-09-09 Dominic Mazzoni <dmazzoni@google.com>
AX: Images within anchors causes crash
https://bugs.webkit.org/show_bug.cgi?id=44149
Reviewed by Chris Fleizach.
Fixes the way parent RenderObject of an AccessibilityRenderObject
is computed in the presence of adjacent continuations.
Test: accessibility/div-within-anchors-causes-crash.html
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::renderParentObject):
2011-09-09 Kulanthaivel Palanichamy <kulanthaivel@codeaurora.org>
CSS rules not being applied when a hidden field is inserted between an input[type=checkbox] and a label
......@@ -414,13 +414,17 @@ RenderObject* AccessibilityRenderObject::renderParentObject() const
else if (parent && (firstChild = parent->firstChild()) && firstChild->node()) {
// Get the node's renderer and follow that continuation chain until the first child is found
RenderObject* nodeRenderFirstChild = firstChild->node()->renderer();
if (nodeRenderFirstChild != firstChild) {
while (nodeRenderFirstChild != firstChild) {
for (RenderObject* contsTest = nodeRenderFirstChild; contsTest; contsTest = nextContinuation(contsTest)) {
if (contsTest == firstChild) {
parent = nodeRenderFirstChild->parent();
break;
}
}
if (firstChild == parent->firstChild())
break;
firstChild = parent->firstChild();
nodeRenderFirstChild = firstChild->node()->renderer();
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment