Commit 415cfd7a authored by cfleizach@apple.com's avatar cfleizach@apple.com

crash with AX on when an image map contains an anchor tag

https://bugs.webkit.org/show_bug.cgi?id=30739

Reviewed by Darin Adler.

WebCore: 

Tests: accessibility/crashing-a-tag-in-map.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::addChildren):

LayoutTests: 

* accessibility/crashing-a-tag-in-map-expected.txt: Added.
* accessibility/crashing-a-tag-in-map.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@50062 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 9d815fa1
2009-10-26 Chris Fleizach <cfleizach@apple.com>
Reviewed by Darin Adler.
crash with AX on when an image map contains an anchor tag
https://bugs.webkit.org/show_bug.cgi?id=30739
* accessibility/crashing-a-tag-in-map-expected.txt: Added.
* accessibility/crashing-a-tag-in-map.html: Added.
2009-10-26 Csaba Osztrogonác <ossy@webkit.org>
Rubber-stamped by Tor Arne Vestbø.
......
This tests that a hit test on a image map that has areas and anchors does not crash
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS successfullyParsed is true
TEST COMPLETE
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
<script>
var successfullyParsed = false;
</script>
<script src="../fast/js/resources/js-test-pre.js"></script>
</head>
<body id="body">
<div class="body">
<img src="resources/cake.png" height="500" width="613" border="0" usemap="#img">
<map id="img" name="img">
<area shape="rect" coords="97,45,5,5" href="test.html" alt="">
<area shape="rect" coords="447,45,5,5" href="test.html">
<a href="test.html"></a>
<area shape="default" nohref="nohref" alt="">
</map></div>
<p id="description"></p>
<div id="console"></div>
<script>
description("This tests that a hit test on a image map that has areas and anchors does not crash");
if (window.accessibilityController) {
var body = document.getElementById("body");
body.focus();
// test fails if it crashes here
var control = accessibilityController.focusedElement.elementAtPoint(100, 100);
}
successfullyParsed = true;
</script>
<script src="../fast/js/resources/js-test-post.js"></script>
</body>
</html>
2009-10-26 Chris Fleizach <cfleizach@apple.com>
Reviewed by Darin Adler.
crash with AX on when an image map contains an anchor tag
https://bugs.webkit.org/show_bug.cgi?id=30739
Tests: accessibility/crashing-a-tag-in-map.html
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::addChildren):
2009-10-26 Steve Block <steveblock@google.com>
Reviewed by Eric Seidel.
......@@ -2580,7 +2580,7 @@ void AccessibilityRenderObject::addChildren()
for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
// add an <area> element for this child if it has a link
if (current->isLink()) {
if (current->hasTagName(areaTag) && current->isLink()) {
AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->getOrCreate(ImageMapLinkRole));
areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(current));
areaObject->setHTMLMapElement(map);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment