Title: [148496] branches/safari-536.30-branch
- Revision
- 148496
- Author
- [email protected]
- Date
- 2013-04-16 00:04:55 -0700 (Tue, 16 Apr 2013)
Log Message
Merged r142631.
Source/WebCore:
2013-02-12 Dominic Mazzoni <[email protected]>
ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
https://bugs.webkit.org/show_bug.cgi?id=109452
Reviewed by Chris Fleizach.
Send the accessibility childrenChanged notification in
HTMLSelectElement::setRecalcListItems instead of in childrenChanged
so that all possible codepaths are caught.
Test: accessibility/insert-selected-option-into-select-causes-crash.html
* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::childrenChanged):
(WebCore::HTMLSelectElement::setRecalcListItems):
LayoutTests:
Updated the test to account for the lack of accessibleElementById.
2013-02-12 Dominic Mazzoni <[email protected]>
ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
https://bugs.webkit.org/show_bug.cgi?id=109452
Reviewed by Chris Fleizach.
Add test to ensure a crash doesn't happen if a selected option
is added to a select element, which was triggering a code path where
the DOM has added a new child of the select but the accessibility
object never got updated.
* accessibility/insert-selected-option-into-select-causes-crash-expected.txt: Added.
* accessibility/insert-selected-option-into-select-causes-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (148495 => 148496)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-04-16 06:12:22 UTC (rev 148495)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-04-16 07:04:55 UTC (rev 148496)
@@ -1,3 +1,24 @@
+2013-04-16 Andy Estes <[email protected]>
+
+ Merged r142631.
+
+ Updated the test to account for the lack of accessibleElementById.
+
+ 2013-02-12 Dominic Mazzoni <[email protected]>
+
+ ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
+ https://bugs.webkit.org/show_bug.cgi?id=109452
+
+ Reviewed by Chris Fleizach.
+
+ Add test to ensure a crash doesn't happen if a selected option
+ is added to a select element, which was triggering a code path where
+ the DOM has added a new child of the select but the accessibility
+ object never got updated.
+
+ * accessibility/insert-selected-option-into-select-causes-crash-expected.txt: Added.
+ * accessibility/insert-selected-option-into-select-causes-crash.html: Added.
+
2013-04-15 Andy Estes <[email protected]>
Merged r139444.
Added: branches/safari-536.30-branch/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash-expected.txt (0 => 148496)
--- branches/safari-536.30-branch/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash-expected.txt 2013-04-16 07:04:55 UTC (rev 148496)
@@ -0,0 +1,9 @@
+This test ensures that inserting a selected option into an HTML Select element doesn't cause a crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: branches/safari-536.30-branch/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash.html (0 => 148496)
--- branches/safari-536.30-branch/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/accessibility/insert-selected-option-into-select-causes-crash.html 2013-04-16 07:04:55 UTC (rev 148496)
@@ -0,0 +1,36 @@
+<!doctype html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<select id="popup">
+ <optgroup id=optgroup1>
+ </optgroup>
+</select>
+<select id="listbox" multiple>
+ <optgroup id=optgroup2>
+ <option selected>
+ </optgroup>
+</select>
+
+<script>
+ description("This test ensures that inserting a selected option into an HTML Select element doesn't cause a crash.");
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ var optgroup1 = document.getElementById('optgroup1');
+ var optgroup2 = document.getElementById('optgroup2');
+
+ if (window.accessibilityController)
+ accessibilityController.rootElement.childAtIndex(0);
+
+ var listbox = document.getElementById('listbox');
+ listbox.focus();
+
+ optgroup1.appendChild(optgroup2);
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (148495 => 148496)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-04-16 06:12:22 UTC (rev 148495)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-04-16 07:04:55 UTC (rev 148496)
@@ -1,3 +1,24 @@
+2013-04-16 Andy Estes <[email protected]>
+
+ Merged r142631.
+
+ 2013-02-12 Dominic Mazzoni <[email protected]>
+
+ ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
+ https://bugs.webkit.org/show_bug.cgi?id=109452
+
+ Reviewed by Chris Fleizach.
+
+ Send the accessibility childrenChanged notification in
+ HTMLSelectElement::setRecalcListItems instead of in childrenChanged
+ so that all possible codepaths are caught.
+
+ Test: accessibility/insert-selected-option-into-select-causes-crash.html
+
+ * html/HTMLSelectElement.cpp:
+ (WebCore::HTMLSelectElement::childrenChanged):
+ (WebCore::HTMLSelectElement::setRecalcListItems):
+
2013-04-15 Andy Estes <[email protected]>
Merged r139444.
Modified: branches/safari-536.30-branch/Source/WebCore/html/HTMLSelectElement.cpp (148495 => 148496)
--- branches/safari-536.30-branch/Source/WebCore/html/HTMLSelectElement.cpp 2013-04-16 06:12:22 UTC (rev 148495)
+++ branches/safari-536.30-branch/Source/WebCore/html/HTMLSelectElement.cpp 2013-04-16 07:04:55 UTC (rev 148496)
@@ -364,9 +364,6 @@
setNeedsValidityCheck();
HTMLFormControlElementWithState::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
- if (AXObjectCache::accessibilityEnabled() && renderer())
- renderer()->document()->axObjectCache()->childrenChanged(renderer());
}
void HTMLSelectElement::optionElementChildrenChanged()
@@ -704,6 +701,8 @@
setNeedsStyleRecalc();
if (!inDocument() && m_optionsCollection)
m_optionsCollection->invalidateCacheIfNeeded();
+ if (AXObjectCache::accessibilityEnabled() && renderer())
+ renderer()->document()->axObjectCache()->childrenChanged(renderer());
}
void HTMLSelectElement::recalcListItems(bool updateSelectedStates) const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
