Skip to content
  • cfleizach@apple.com's avatar
    Bug 69562 - AccessibilityImageMapLink holds onto it's parent even after it's been freed · 133429e3
    cfleizach@apple.com authored
    https://bugs.webkit.org/show_bug.cgi?id=69562
    
    Source/WebCore: 
    
    Some fake objects, like AXImageMapLink, have weak references to their parent's (since they are fake objects and
    need some connection to the parent). However, if the parent disappears before the child, then we're left with a 
    out of date reference to that parent.
    
    The fix is to allow these elements to clear their parentage when the parent goes away.
    
    Reviewed by Darin Adler.
    
    Test: accessibility/image-map-update-parent-crash.html
    
    * accessibility/AccessibilityMenuListOption.cpp:
    (WebCore::AccessibilityMenuListOption::isVisible):
    * accessibility/AccessibilityMenuListPopup.cpp:
    (WebCore::AccessibilityMenuListPopup::isOffScreen):
    (WebCore::AccessibilityMenuListPopup::isEnabled):
    (WebCore::AccessibilityMenuListPopup::press):
    (WebCore::AccessibilityMenuListPopup::addChildren):
    (WebCore::AccessibilityMenuListPopup::childrenChanged):
    * accessibility/AccessibilityMockObject.h:
    (WebCore::AccessibilityMockObject::detachFromParent):
    * accessibility/AccessibilityObject.cpp:
    (WebCore::AccessibilityObject::clearChildren):
    * accessibility/AccessibilityObject.h:
    (WebCore::AccessibilityObject::detachFromParent):
    * accessibility/AccessibilitySlider.cpp:
    (WebCore::AccessibilitySliderThumb::elementRect):
    * accessibility/AccessibilityTableColumn.cpp:
    (WebCore::AccessibilityTableColumn::headerObjectForSection):
    
    LayoutTests: 
    
    Reviewed by Darin Adler.
    
    * accessibility/image-map-update-parent-crash-expected.txt: Added.
    * accessibility/image-map-update-parent-crash.html: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@96973 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    133429e3