Title: [204203] trunk
- Revision
- 204203
- Author
- n_w...@apple.com
- Date
- 2016-08-05 17:01:27 -0700 (Fri, 05 Aug 2016)
Log Message
AX: Asking for group members of radio button that has no name attribute will cause crash
https://bugs.webkit.org/show_bug.cgi?id=160583
Reviewed by Chris Fleizach.
Source/WebCore:
The NameToGroupMap is null when there's no name attribute on the radio buttons. Added a
check so that we don't try to get a value from a null HashSet.
Test: accessibility/mac/radio-button-no-name-crash.html
* dom/RadioButtonGroups.cpp:
(WebCore::RadioButtonGroups::groupMembers):
LayoutTests:
* accessibility/mac/radio-button-no-name-crash-expected.txt: Added.
* accessibility/mac/radio-button-no-name-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (204202 => 204203)
--- trunk/LayoutTests/ChangeLog 2016-08-05 23:57:52 UTC (rev 204202)
+++ trunk/LayoutTests/ChangeLog 2016-08-06 00:01:27 UTC (rev 204203)
@@ -1,3 +1,13 @@
+2016-08-05 Nan Wang <n_w...@apple.com>
+
+ AX: Asking for group members of radio button that has no name attribute will cause crash
+ https://bugs.webkit.org/show_bug.cgi?id=160583
+
+ Reviewed by Chris Fleizach.
+
+ * accessibility/mac/radio-button-no-name-crash-expected.txt: Added.
+ * accessibility/mac/radio-button-no-name-crash.html: Added.
+
2016-08-05 Alexey Proskuryakov <a...@apple.com>
Disk cache tests produce many undefined value warnings
Added: trunk/LayoutTests/accessibility/mac/radio-button-no-name-crash-expected.txt (0 => 204203)
--- trunk/LayoutTests/accessibility/mac/radio-button-no-name-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/mac/radio-button-no-name-crash-expected.txt 2016-08-06 00:01:27 UTC (rev 204203)
@@ -0,0 +1,10 @@
+ Radio
+This test checks that accessing linkedUIElements of radio buttons without name attribute won't cause crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/mac/radio-button-no-name-crash.html (0 => 204203)
--- trunk/LayoutTests/accessibility/mac/radio-button-no-name-crash.html (rev 0)
+++ trunk/LayoutTests/accessibility/mac/radio-button-no-name-crash.html 2016-08-06 00:01:27 UTC (rev 204203)
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+<input type="radio" id="r1">
+<label for=""
+
+<p id="description"></p>
+<div id="console"></div>
+
+ <script>
+
+ description("This test checks that accessing linkedUIElements of radio buttons without name attribute won't cause crash. ");
+
+ if (window.accessibilityController) {
+
+ var radio = accessibilityController.accessibleElementById("r1");
+ // Make sure this won't cause crash.
+ var radioGroupSibling = radio.linkedUIElementAtIndex(0);
+ }
+ </script>
+
+<script src=""
+
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (204202 => 204203)
--- trunk/Source/WebCore/ChangeLog 2016-08-05 23:57:52 UTC (rev 204202)
+++ trunk/Source/WebCore/ChangeLog 2016-08-06 00:01:27 UTC (rev 204203)
@@ -1,3 +1,18 @@
+2016-08-05 Nan Wang <n_w...@apple.com>
+
+ AX: Asking for group members of radio button that has no name attribute will cause crash
+ https://bugs.webkit.org/show_bug.cgi?id=160583
+
+ Reviewed by Chris Fleizach.
+
+ The NameToGroupMap is null when there's no name attribute on the radio buttons. Added a
+ check so that we don't try to get a value from a null HashSet.
+
+ Test: accessibility/mac/radio-button-no-name-crash.html
+
+ * dom/RadioButtonGroups.cpp:
+ (WebCore::RadioButtonGroups::groupMembers):
+
2016-08-05 Brent Fulgham <bfulg...@apple.com>
ASSERTION FAILED: observer in WebCore::BitmapImage::drawPattern
Modified: trunk/Source/WebCore/dom/RadioButtonGroups.cpp (204202 => 204203)
--- trunk/Source/WebCore/dom/RadioButtonGroups.cpp 2016-08-05 23:57:52 UTC (rev 204202)
+++ trunk/Source/WebCore/dom/RadioButtonGroups.cpp 2016-08-06 00:01:27 UTC (rev 204203)
@@ -231,6 +231,9 @@
if (!name)
return { };
+ if (!m_nameToGroupMap)
+ return { };
+
auto* group = m_nameToGroupMap->get(name);
if (!group)
return { };
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
