⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 294186 in webkit


Ignore:
Timestamp:
May 13, 2022, 9:37:21 PM (4 years ago)
Author:
Tyler Wilcock
Message:

Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
​https://bugs.webkit.org/show_bug.cgi?id=240365

Reviewed by Chris Fleizach.

Source/WebCore:

We can get infinite recursion when accessibilityIsIgnored is called as
part of computing AccessibilityObject::ignoredFromModalPresence. One
example of such a cycle:

AXObjectCache::currentModalNode() ->
AccessibilityRenderObject::computeAccessibilityIsIgnored() ->
AccessibilityRenderObject::parentObjectUnignored() ->
AccessibilityObject::accessibilityIsIgnored() ->
AccessibilityObject::ignoredFromModalPresence() ->
AXObjectCache::currentModalNode() ->
...repeat...

This patch fixes this by tracking when we start computing the current
modal node in the AXObjectCache. Then, in AccessibilityObject::accessibilityIsIgnored(),
we don't call AccessibilityObject::ignoredFromModalPresence() if this new state is true,
since in this context we only need to know if the object is inherently
ignored (i.e. ignored disregarding modal presence).

Test: accessibility/aria-modal-with-text-crash.html

  • accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::currentModalNode):

  • accessibility/AXObjectCache.h:

Add m_isRetrievingCurrentModalNode.
(WebCore::AXObjectCache::isRetrievingCurrentModalNode): Added.

  • accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::accessibilityIsIgnored const):
Don't call ignoredFromModalPresence if we're in the midst of computing the current modal.

LayoutTests:

  • accessibility/aria-modal-with-text-crash-expected.txt: Added.
  • accessibility/aria-modal-with-text-crash.html: Added.
  • platform/glib/TestExpectations: Skip new test.
  • platform/ios/TestExpectations: Enable new test.
  • platform/win/TestExpectations: Skip new test.
Location:
trunk
Files:
2 added
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r294170 r294186  
     12022-05-13  Tyler Wilcock  <tyler_w@apple.com>
     2
     3        Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
     4        https://bugs.webkit.org/show_bug.cgi?id=240365
     5
     6        Reviewed by Chris Fleizach.
     7
     8        * accessibility/aria-modal-with-text-crash-expected.txt: Added.
     9        * accessibility/aria-modal-with-text-crash.html: Added.
     10        * platform/glib/TestExpectations: Skip new test.
     11        * platform/ios/TestExpectations: Enable new test.
     12        * platform/win/TestExpectations: Skip new test.
     13
    1142022-05-13  Tim Nguyen  <ntim@apple.com>
    215

  • trunk/LayoutTests/platform/glib/TestExpectations

    r294146 r294186  
    352352
    353353# Missing AccessibilityUIElement::uiElementForSearchPredicate implementation.
     354accessibility/aria-modal-with-text-crash.html [ Skip ]
    354355accessibility/display-contents-search-traversal.html [ Skip ]
    355356accessibility/search-traversal-after-role-change.html [ Skip ]

  • trunk/LayoutTests/platform/ios/TestExpectations

    r294110 r294186  
    21362136webkit.org/b/150366 accessibility/aria-table-attributes.html [ Pass ]
    21372137
     2138accessibility/aria-modal-with-text-crash.html [ Pass ]
    21382139accessibility/display-contents-search-traversal.html [ Pass ]
    21392140accessibility/search-traversal-after-role-change.html [ Pass ]

  • trunk/LayoutTests/platform/win/TestExpectations

    r294067 r294186  
    482482
    483483# Missing AccessibilityUIElement::uiElementForSearchPredicate implementation.
     484accessibility/aria-modal-with-text-crash.html [ Skip ]
    484485accessibility/display-contents-search-traversal.html [ Skip ]
    485486accessibility/search-traversal-after-role-change.html [ Skip ]

  • trunk/Source/WebCore/ChangeLog

    r294182 r294186  
     12022-05-13  Tyler Wilcock  <tyler_w@apple.com>
     2
     3        Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
     4        https://bugs.webkit.org/show_bug.cgi?id=240365
     5
     6        Reviewed by Chris Fleizach.
     7
     8        We can get infinite recursion when accessibilityIsIgnored is called as
     9        part of computing AccessibilityObject::ignoredFromModalPresence. One
     10        example of such a cycle:
     11
     12        AXObjectCache::currentModalNode() ->
     13        AccessibilityRenderObject::computeAccessibilityIsIgnored() ->
     14        AccessibilityRenderObject::parentObjectUnignored() ->
     15        AccessibilityObject::accessibilityIsIgnored() ->
     16        AccessibilityObject::ignoredFromModalPresence() ->
     17        AXObjectCache::currentModalNode() ->
     18        ...repeat...
     19
     20        This patch fixes this by tracking when we start computing the current
     21        modal node in the AXObjectCache. Then, in AccessibilityObject::accessibilityIsIgnored(),
     22        we don't call AccessibilityObject::ignoredFromModalPresence() if this new state is true,
     23        since in this context we only need to know if the object is inherently
     24        ignored (i.e. ignored disregarding modal presence).
     25
     26        Test: accessibility/aria-modal-with-text-crash.html
     27
     28        * accessibility/AXObjectCache.cpp:
     29        (WebCore::AXObjectCache::currentModalNode):
     30        * accessibility/AXObjectCache.h:
     31        Add m_isRetrievingCurrentModalNode.
     32        (WebCore::AXObjectCache::isRetrievingCurrentModalNode): Added.
     33        * accessibility/AccessibilityObject.cpp:
     34        (WebCore::AccessibilityObject::accessibilityIsIgnored const):
     35        Don't call ignoredFromModalPresence if we're in the midst of computing the current modal.
     36
    1372022-05-13  Brent Fulgham  <bfulgham@apple.com>
    238

  • trunk/Source/WebCore/accessibility/AXObjectCache.cpp

    r294167 r294186  
    307307    }
    308308
     309    SetForScope retrievingCurrentModalNode(m_isRetrievingCurrentModalNode, true);
    309310    // If any of the modal nodes contains the keyboard focus, we want to pick that one.
    310311    // If not, we want to pick the last visible dialog in the DOM.

  • trunk/Source/WebCore/accessibility/AXObjectCache.h

    r294167 r294186  
    200200    void handleScrolledToAnchor(const Node* anchorNode);
    201201    void handleScrollbarUpdate(ScrollView*);
    202    
     202
     203    bool isRetrievingCurrentModalNode() { return m_isRetrievingCurrentModalNode; }
    203204    Node* modalNode();
    204205
    … …  
    519520    ListHashSet<Element*> m_modalElementsSet;
    520521    bool m_modalNodesInitialized { false };
     522    bool m_isRetrievingCurrentModalNode { false };
    521523
    522524    Timer m_performCacheUpdateTimer;

  • trunk/Source/WebCore/accessibility/AccessibilityObject.cpp

    r293650 r294186  
    37473747    }
    37483748
    3749     bool ignored = ignoredFromModalPresence();
     3749    // If we are in the midst of retrieving the current modal node, we only need to consider whether the object
     3750    // is inherently ignored via computeAccessibilityIsIgnored. Also, calling ignoredFromModalPresence
     3751    // in this state would cause infinite recursion.
     3752    bool ignored = cache && cache->isRetrievingCurrentModalNode() ? false : ignoredFromModalPresence();
    37503753    if (!ignored)
    37513754        ignored = computeAccessibilityIsIgnored();
Note: See TracChangeset for help on using the changeset viewer.