Changeset 140393 in webkit

Timestamp:

Jan 22, 2013, 12:33:45 AM (14 years ago)

Author:

dmazzoni@google.com

Message:

AX: Should assert if we try to create two AXObjects that point to the same renderer or node
​https://bugs.webkit.org/show_bug.cgi?id=107504

Reviewed by Chris Fleizach.

If two accessibility objects get created that point to the
same widget, renderer, or node, that can lead to crashes or
memory corruption later; make it assert instead of crashing.

• accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::getOrCreate):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• accessibility/AXObjectCache.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-22  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Should assert if we try to create two AXObjects that point to the same renderer or node
+        https://bugs.webkit.org/show_bug.cgi?id=107504
+
+        Reviewed by Chris Fleizach.
+
+        If two accessibility objects get created that point to the
+        same widget, renderer, or node, that can lead to crashes or
+        memory corruption later; make it assert instead of crashing.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+
 2013-01-22  Kentaro Hara  <haraken@chromium.org>
 

trunk/Source/WebCore/accessibility/AXObjectCache.cpp

@@ -306 +306 @@
     else if (widget->isScrollbar())
         newObj = AccessibilityScrollbar::create(static_cast<Scrollbar*>(widget));
+
+    // Will crash later if we have two objects for the same widget.
+    ASSERT(!get(widget));
         
     getAXID(newObj.get());
@@ -338 +341 @@
     RefPtr<AccessibilityObject> newObj = createFromNode(node);
 
+    // Will crash later if we have two objects for the same node.
+    ASSERT(!get(node));
+
     getAXID(newObj.get());
 
@@ -358 +364 @@
 
     RefPtr<AccessibilityObject> newObj = createFromRenderer(renderer);
+
+    // Will crash later if we have two objects for the same renderer.
+    ASSERT(!get(renderer));
 
     getAXID(newObj.get());