Title: [223881] trunk
- Revision
- 223881
- Author
- n_w...@apple.com
- Date
- 2017-10-24 00:25:08 -0700 (Tue, 24 Oct 2017)
Log Message
AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] + 24
https://bugs.webkit.org/show_bug.cgi?id=178697
Reviewed by Chris Fleizach.
Source/WebCore:
When we are calling _accessibilityMinValue and _accessibilityMaxValue on iOS,
it might cause crash if the AX object has already been detached. Fixed this
by adding the necessary checks.
Test: accessibility/ios-simulator/slider-min-value-crash.html
* accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper _accessibilityMinValue]):
(-[WebAccessibilityObjectWrapper _accessibilityMaxValue]):
LayoutTests:
* accessibility/ios-simulator/slider-min-value-crash-expected.txt: Added.
* accessibility/ios-simulator/slider-min-value-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (223880 => 223881)
--- trunk/LayoutTests/ChangeLog 2017-10-24 05:13:56 UTC (rev 223880)
+++ trunk/LayoutTests/ChangeLog 2017-10-24 07:25:08 UTC (rev 223881)
@@ -1,3 +1,13 @@
+2017-10-24 Nan Wang <n_w...@apple.com>
+
+ AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] + 24
+ https://bugs.webkit.org/show_bug.cgi?id=178697
+
+ Reviewed by Chris Fleizach.
+
+ * accessibility/ios-simulator/slider-min-value-crash-expected.txt: Added.
+ * accessibility/ios-simulator/slider-min-value-crash.html: Added.
+
2017-10-23 Michael Catanzaro <mcatanz...@igalia.com>
Unreviewed WPE test gardening
Added: trunk/LayoutTests/accessibility/ios-simulator/slider-min-value-crash-expected.txt (0 => 223881)
--- trunk/LayoutTests/accessibility/ios-simulator/slider-min-value-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/ios-simulator/slider-min-value-crash-expected.txt 2017-10-24 07:25:08 UTC (rev 223881)
@@ -0,0 +1,11 @@
+This tests that accessing the min/max value of a detached ax object won't cause crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sliderObj.minValue is 25
+PASS sliderObj.minValue is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/ios-simulator/slider-min-value-crash.html (0 => 223881)
--- trunk/LayoutTests/accessibility/ios-simulator/slider-min-value-crash.html (rev 0)
+++ trunk/LayoutTests/accessibility/ios-simulator/slider-min-value-crash.html 2017-10-24 07:25:08 UTC (rev 223881)
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body id="body">
+
+<input type="range" id="slider" value="50" min="25" max="75">
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+ description("This tests that accessing the min/max value of a detached ax object won't cause crash.");
+
+ if (window.accessibilityController) {
+
+ var sliderObj = accessibilityController.accessibleElementById("slider");
+ shouldBe("sliderObj.minValue", "25");
+
+ // Remove the element
+ var slider = document.getElementById("slider");
+ slider.parentNode.removeChild(slider);
+
+ // Make sure it won't crash
+ shouldBe("sliderObj.minValue", "0");
+ }
+
+</script>
+
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (223880 => 223881)
--- trunk/Source/WebCore/ChangeLog 2017-10-24 05:13:56 UTC (rev 223880)
+++ trunk/Source/WebCore/ChangeLog 2017-10-24 07:25:08 UTC (rev 223881)
@@ -1,3 +1,20 @@
+2017-10-24 Nan Wang <n_w...@apple.com>
+
+ AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] + 24
+ https://bugs.webkit.org/show_bug.cgi?id=178697
+
+ Reviewed by Chris Fleizach.
+
+ When we are calling _accessibilityMinValue and _accessibilityMaxValue on iOS,
+ it might cause crash if the AX object has already been detached. Fixed this
+ by adding the necessary checks.
+
+ Test: accessibility/ios-simulator/slider-min-value-crash.html
+
+ * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+ (-[WebAccessibilityObjectWrapper _accessibilityMinValue]):
+ (-[WebAccessibilityObjectWrapper _accessibilityMaxValue]):
+
2017-10-23 Keith Miller <keith_mil...@apple.com>
Unreviewed, restore unneeded all in ones.
Modified: trunk/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm (223880 => 223881)
--- trunk/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm 2017-10-24 05:13:56 UTC (rev 223880)
+++ trunk/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm 2017-10-24 07:25:08 UTC (rev 223881)
@@ -1085,11 +1085,17 @@
- (CGFloat)_accessibilityMinValue
{
+ if (![self _prepareAccessibilityCall])
+ return 0;
+
return m_object->minValueForRange();
}
- (CGFloat)_accessibilityMaxValue
{
+ if (![self _prepareAccessibilityCall])
+ return 0;
+
return m_object->maxValueForRange();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
