Title: [219917] branches/safari-604-branch
- Revision
- 219917
- Author
- [email protected]
- Date
- 2017-07-26 02:51:31 -0700 (Wed, 26 Jul 2017)
Log Message
Cherry-pick r219638. rdar://problem/33523787
Modified Paths
Added Paths
Diff
Modified: branches/safari-604-branch/LayoutTests/ChangeLog (219916 => 219917)
--- branches/safari-604-branch/LayoutTests/ChangeLog 2017-07-26 09:51:28 UTC (rev 219916)
+++ branches/safari-604-branch/LayoutTests/ChangeLog 2017-07-26 09:51:31 UTC (rev 219917)
@@ -1,5 +1,21 @@
2017-07-26 Jason Marcell <[email protected]>
+ Cherry-pick r219638. rdar://problem/33523787
+
+ 2017-07-18 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r218910): Crash when password field changes to text field
+ https://bugs.webkit.org/show_bug.cgi?id=174560
+
+ Reviewed by Zalan Bujtas.
+
+ Added a regression test based on the test case provided by Daniel Bates.
+
+ * accessibility/mac/input-type-change-crash-2-expected.txt: Added.
+ * accessibility/mac/input-type-change-crash-2.html: Added.
+
+2017-07-26 Jason Marcell <[email protected]>
+
Cherry-pick r219610. rdar://problem/33523847
2017-07-18 Said Abou-Hallawa <[email protected]>
Added: branches/safari-604-branch/LayoutTests/accessibility/mac/input-type-change-crash-2-expected.txt (0 => 219917)
--- branches/safari-604-branch/LayoutTests/accessibility/mac/input-type-change-crash-2-expected.txt (rev 0)
+++ branches/safari-604-branch/LayoutTests/accessibility/mac/input-type-change-crash-2-expected.txt 2017-07-26 09:51:31 UTC (rev 219917)
@@ -0,0 +1,3 @@
+This tests changing the password field's type to text while the accessibility tree is turned on. WebKit should not crash.
+
+PASS - WebKit did not crash.
Added: branches/safari-604-branch/LayoutTests/accessibility/mac/input-type-change-crash-2.html (0 => 219917)
--- branches/safari-604-branch/LayoutTests/accessibility/mac/input-type-change-crash-2.html (rev 0)
+++ branches/safari-604-branch/LayoutTests/accessibility/mac/input-type-change-crash-2.html 2017-07-26 09:51:31 UTC (rev 219917)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests changing the password field's type to text while the accessibility tree is turned on. WebKit should not crash.</p>
+<input type="password" value="hello" _onmouseup_="this.setAttribute('type', 'text')">
+<script>
+if (!window.accessibilityController) {
+ document.write('Click the text input on the left. WebKit should not crash.');
+} else {
+ testRunner.dumpAsText();
+ accessibilityController.enableEnhancedAccessibility(true);
+ internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
+ const input = document.querySelector('input');
+ input.type = 'text';
+ input.remove();
+ document.write('PASS - WebKit did not crash.');
+}
+
+</script>
+</body>
+</html>
Modified: branches/safari-604-branch/Source/WebCore/ChangeLog (219916 => 219917)
--- branches/safari-604-branch/Source/WebCore/ChangeLog 2017-07-26 09:51:28 UTC (rev 219916)
+++ branches/safari-604-branch/Source/WebCore/ChangeLog 2017-07-26 09:51:31 UTC (rev 219917)
@@ -1,5 +1,30 @@
2017-07-26 Jason Marcell <[email protected]>
+ Cherry-pick r219638. rdar://problem/33523787
+
+ 2017-07-18 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r218910): Crash when password field changes to text field
+ https://bugs.webkit.org/show_bug.cgi?id=174560
+
+ Reviewed by Zalan Bujtas.
+
+ The crash was caused by textMarkerDataForFirstPositionInTextControl accessing a nullptr returned by getOrCreate.
+ Unfortunately, in order to this fix bug while preserving the exact behavior would require synchronously creating
+ a renderer for the editing host when the input type changed since we can't create an accessbility object out of
+ a renderer-less node.
+
+ Instead, revert back to pre-r218910 behavior of always using the text control element's axID when notifying
+ the value change. While this is inconsistent with the way editing commands report content changes, I've since
+ learned that VoiceOver has code to deal with this exact situation.
+
+ Test: accessibility/mac/input-type-change-crash-2.html
+
+ * accessibility/AXObjectCache.cpp:
+ (WebCore::AXObjectCache::textMarkerDataForFirstPositionInTextControl):
+
+2017-07-26 Jason Marcell <[email protected]>
+
Cherry-pick r219610. rdar://problem/33523847
2017-07-18 Said Abou-Hallawa <[email protected]>
Modified: branches/safari-604-branch/Source/WebCore/accessibility/AXObjectCache.cpp (219916 => 219917)
--- branches/safari-604-branch/Source/WebCore/accessibility/AXObjectCache.cpp 2017-07-26 09:51:28 UTC (rev 219916)
+++ branches/safari-604-branch/Source/WebCore/accessibility/AXObjectCache.cpp 2017-07-26 09:51:31 UTC (rev 219917)
@@ -2177,27 +2177,17 @@
// This function exits as a performance optimization to avoid a synchronous layout.
std::optional<TextMarkerData> AXObjectCache::textMarkerDataForFirstPositionInTextControl(HTMLTextFormControlElement& textControl)
{
- TextControlInnerTextElement* innerTextElement = textControl.innerTextElement();
- if (!innerTextElement)
- return std::nullopt;
-
if (is<HTMLInputElement>(textControl) && downcast<HTMLInputElement>(textControl).isPasswordField())
return std::nullopt;
- Position firstPosition = firstPositionInNode(innerTextElement);
- Node* firstChild = innerTextElement->firstChild();
- if (!firstChild)
- firstChild = innerTextElement;
- ContainerNode* editingHost = highestEditableRoot(firstPosition);
- if (!editingHost) // textControl is no longer editable. e.g. readonly or disabled.
+ AXObjectCache* cache = textControl.document().axObjectCache();
+ RefPtr<AccessibilityObject> obj = cache->getOrCreate(&textControl);
+ if (!obj)
return std::nullopt;
- AXObjectCache* cache = textControl.document().axObjectCache();
- RefPtr<AccessibilityObject> obj = cache->getOrCreate(editingHost);
-
TextMarkerData textMarkerData;
textMarkerData.axID = obj.get()->axObjectID();
- textMarkerData.node = firstChild;
+ textMarkerData.node = &textControl;
cache->setNodeInUse(&textControl);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
