Title: [200318] trunk
- Revision
- 200318
- Author
- n_w...@apple.com
- Date
- 2016-05-01 23:14:36 -0700 (Sun, 01 May 2016)
Log Message
AX: Crash at WebCore::AccessibilityObject::getAttribute const + 9
https://bugs.webkit.org/show_bug.cgi?id=157256
Reviewed by Chris Fleizach.
Source/WebCore:
When the <label> for the input element has no renderer, it will cause
crash when we ask for the title element text. Fixed it by getting the
aria-label attribute directly from the <label> element instead of its
accessibility object.
Test case covered in accessibility/mac/aria-label-on-label-element.html.
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::titleElementText):
LayoutTests:
* accessibility/mac/aria-label-on-label-element-expected.txt:
* accessibility/mac/aria-label-on-label-element.html:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (200317 => 200318)
--- trunk/LayoutTests/ChangeLog 2016-05-02 06:05:57 UTC (rev 200317)
+++ trunk/LayoutTests/ChangeLog 2016-05-02 06:14:36 UTC (rev 200318)
@@ -1,3 +1,13 @@
+2016-05-01 Nan Wang <n_w...@apple.com>
+
+ AX: Crash at WebCore::AccessibilityObject::getAttribute const + 9
+ https://bugs.webkit.org/show_bug.cgi?id=157256
+
+ Reviewed by Chris Fleizach.
+
+ * accessibility/mac/aria-label-on-label-element-expected.txt:
+ * accessibility/mac/aria-label-on-label-element.html:
+
2016-05-01 Commit Queue <commit-qu...@webkit.org>
Unreviewed, rolling out r200264 and r200266.
Modified: trunk/LayoutTests/accessibility/mac/aria-label-on-label-element-expected.txt (200317 => 200318)
--- trunk/LayoutTests/accessibility/mac/aria-label-on-label-element-expected.txt 2016-05-02 06:05:57 UTC (rev 200317)
+++ trunk/LayoutTests/accessibility/mac/aria-label-on-label-element-expected.txt 2016-05-02 06:14:36 UTC (rev 200318)
@@ -1,4 +1,4 @@
-Some text Some other text
+Some text Some other text
This tests that the aria-label attribute works on element.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
@@ -7,6 +7,7 @@
PASS !titleUIElement1 is true
PASS input1.title is 'AXTitle: aria label'
PASS titleUIElement2.isEqual(accessibilityController.accessibleElementById('label2')) is true
+PASS input3.title is 'AXTitle: hidden aria label'
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/accessibility/mac/aria-label-on-label-element.html (200317 => 200318)
--- trunk/LayoutTests/accessibility/mac/aria-label-on-label-element.html 2016-05-02 06:05:57 UTC (rev 200317)
+++ trunk/LayoutTests/accessibility/mac/aria-label-on-label-element.html 2016-05-02 06:14:36 UTC (rev 200318)
@@ -11,6 +11,9 @@
<label id="label2" for="" other text</label>
<input id="input2" type="text" size=20>
+<label id="label3" for="" hidden aria-label="hidden aria label">hidden text</label>
+<input id="input3" type="text">
+
<p id="description"></p>
<div id="console"></div>
@@ -30,6 +33,10 @@
var input2 = accessibilityController.accessibleElementById("input2");
var titleUIElement2 = input2.titleUIElement();
shouldBeTrue("titleUIElement2.isEqual(accessibilityController.accessibleElementById('label2'))");
+
+ // Make sure when the input element has no rendered label, it won't cause crash.
+ var input3 = accessibilityController.accessibleElementById("input3");
+ shouldBe("input3.title", "'AXTitle: hidden aria label'");
}
</script>
Modified: trunk/Source/WebCore/ChangeLog (200317 => 200318)
--- trunk/Source/WebCore/ChangeLog 2016-05-02 06:05:57 UTC (rev 200317)
+++ trunk/Source/WebCore/ChangeLog 2016-05-02 06:14:36 UTC (rev 200318)
@@ -1,3 +1,20 @@
+2016-05-01 Nan Wang <n_w...@apple.com>
+
+ AX: Crash at WebCore::AccessibilityObject::getAttribute const + 9
+ https://bugs.webkit.org/show_bug.cgi?id=157256
+
+ Reviewed by Chris Fleizach.
+
+ When the <label> for the input element has no renderer, it will cause
+ crash when we ask for the title element text. Fixed it by getting the
+ aria-label attribute directly from the <label> element instead of its
+ accessibility object.
+
+ Test case covered in accessibility/mac/aria-label-on-label-element.html.
+
+ * accessibility/AccessibilityNodeObject.cpp:
+ (WebCore::AccessibilityNodeObject::titleElementText):
+
2016-05-01 Darin Adler <da...@apple.com>
Stop using string-based enumerations in TextTrack, and eliminate support for string-based enumerations
Modified: trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp (200317 => 200318)
--- trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp 2016-05-02 06:05:57 UTC (rev 200317)
+++ trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp 2016-05-02 06:14:36 UTC (rev 200318)
@@ -1266,7 +1266,7 @@
AccessibilityObject* labelObject = axObjectCache()->getOrCreate(label);
String innerText = label->innerText();
- const AtomicString& ariaLabel = labelObject->getAttribute(aria_labelAttr);
+ const AtomicString& ariaLabel = label->fastGetAttribute(aria_labelAttr);
if (!ariaLabel.isEmpty())
innerText = ariaLabel;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
