Commit 7c58a0dc authored by commit-queue@webkit.org's avatar commit-queue@webkit.org
Browse files

[GTK] [Stable] Infinite recursion in WebCore::AXObjectCache::getOrCreate

https://bugs.webkit.org/show_bug.cgi?id=96932

Patch by Joanmarie Diggs <jdiggs@igalia.com> on 2012-09-21
Reviewed by Martin Robinson.

Source/WebCore:

Make the decision based on RenderObjects rather than AccessibilityObjects
to avoid the infinite recursion which occurs when remapAriaRoleDueToParent
gets called.

Test: platform/gtk/accessibility/remapped-aria-crash.html

* accessibility/gtk/AccessibilityObjectAtk.cpp:
(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

LayoutTests:

Added a new test which replicates the recursion and crash.

* platform/gtk/accessibility/remapped-aria-crash-expected.txt: Added.
* platform/gtk/accessibility/remapped-aria-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129246 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent df97e985
2012-09-21 Joanmarie Diggs <jdiggs@igalia.com>
[GTK] [Stable] Infinite recursion in WebCore::AXObjectCache::getOrCreate
https://bugs.webkit.org/show_bug.cgi?id=96932
Reviewed by Martin Robinson.
Added a new test which replicates the recursion and crash.
* platform/gtk/accessibility/remapped-aria-crash-expected.txt: Added.
* platform/gtk/accessibility/remapped-aria-crash.html: Added.
2012-09-21 Gavin Barraclough <barraclough@apple.com>
 
Global Math object should be configurable but isn't
Test to ensure a remapped ARIA role does not produce a crash.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS successfullyParsed is true
TEST COMPLETE
<html>
<head>
<script src="../../../fast/js/resources/js-test-pre.js"></script>
</head>
<body>
<div>
<a role="option"></a>
</div>
<p id="description"></p>
<div id="console"></div>
<script>
description("Test to ensure a remapped ARIA role does not produce a crash.");
if (window.testRunner) {
testRunner.dumpAsText();
}
document.body.focus();
if (window.accessibilityController) {
function touchTheEntireAccessibilityTree(accessibilityObject) {
for (var i = 0; i < accessibilityObject.childrenCount; ++i)
touchTheEntireAccessibilityTree(accessibilityObject.childAtIndex(i));
}
touchTheEntireAccessibilityTree(accessibilityController.focusedElement);
}
</script>
<script src="../../../fast/js/resources/js-test-post.js"></script>
</body>
</html>
2012-09-21 Joanmarie Diggs <jdiggs@igalia.com>
[GTK] [Stable] Infinite recursion in WebCore::AXObjectCache::getOrCreate
https://bugs.webkit.org/show_bug.cgi?id=96932
Reviewed by Martin Robinson.
Make the decision based on RenderObjects rather than AccessibilityObjects
to avoid the infinite recursion which occurs when remapAriaRoleDueToParent
gets called.
Test: platform/gtk/accessibility/remapped-aria-crash.html
* accessibility/gtk/AccessibilityObjectAtk.cpp:
(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
2012-09-21 Jonathan Dong <jonathan.dong@torchmobile.com.cn>
 
[BlackBerry] HTML5 media does not handle SSL certificate failures
......@@ -84,13 +84,16 @@ AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesO
// usually have no need for the anonymous block. And when the wrong objects
// get included or ignored, needed accessibility signals do not get emitted.
if (role == ParagraphRole || role == DivRole) {
AccessibilityObject* child = firstAnonymousBlockChild();
if (!child)
if (textUnderElement().isEmpty())
return DefaultBehavior;
child = child->firstChild();
if (child && (child->isLink() || !child->firstAnonymousBlockChild()))
return IncludeObject;
if (!parent->renderer() || parent->renderer()->isAnonymousBlock())
return DefaultBehavior;
for (RenderObject* r = renderer()->firstChild(); r; r = r->nextSibling()) {
if (r->isAnonymousBlock())
return IncludeObject;
}
}
// Block spans result in objects of ATK_ROLE_PANEL which are almost always unwanted.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment