⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 294739 in webkit


Ignore:
Timestamp:
May 23, 2022, 11:14:12 PM (4 years ago)
Author:
Alan Coon
Message:

Cherry-pick r294186. rdar://problem/93805727

Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
​https://bugs.webkit.org/show_bug.cgi?id=240365

Reviewed by Chris Fleizach.

Source/WebCore:

We can get infinite recursion when accessibilityIsIgnored is called as
part of computing AccessibilityObject::ignoredFromModalPresence. One
example of such a cycle:

AXObjectCache::currentModalNode() ->
AccessibilityRenderObject::computeAccessibilityIsIgnored() ->
AccessibilityRenderObject::parentObjectUnignored() ->
AccessibilityObject::accessibilityIsIgnored() ->
AccessibilityObject::ignoredFromModalPresence() ->
AXObjectCache::currentModalNode() ->
...repeat...

This patch fixes this by tracking when we start computing the current
modal node in the AXObjectCache. Then, in AccessibilityObject::accessibilityIsIgnored(),
we don't call AccessibilityObject::ignoredFromModalPresence() if this new state is true,
since in this context we only need to know if the object is inherently
ignored (i.e. ignored disregarding modal presence).

Test: accessibility/aria-modal-with-text-crash.html

  • accessibility/AXObjectCache.cpp: (WebCore::AXObjectCache::currentModalNode):
  • accessibility/AXObjectCache.h: Add m_isRetrievingCurrentModalNode. (WebCore::AXObjectCache::isRetrievingCurrentModalNode): Added.
  • accessibility/AccessibilityObject.cpp: (WebCore::AccessibilityObject::accessibilityIsIgnored const): Don't call ignoredFromModalPresence if we're in the midst of computing the current modal.

LayoutTests:

  • accessibility/aria-modal-with-text-crash-expected.txt: Added.
  • accessibility/aria-modal-with-text-crash.html: Added.
  • platform/glib/TestExpectations: Skip new test.
  • platform/ios/TestExpectations: Enable new test.
  • platform/win/TestExpectations: Skip new test.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@294186 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-7614.1.14.1-branch
Files:
2 added
8 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-7614.1.14.1-branch/LayoutTests/ChangeLog

    r294129 r294739  
     12022-05-23  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r294186. rdar://problem/93805727
     4
     5    Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
     6    https://bugs.webkit.org/show_bug.cgi?id=240365
     7   
     8    Reviewed by Chris Fleizach.
     9   
     10    Source/WebCore:
     11   
     12    We can get infinite recursion when accessibilityIsIgnored is called as
     13    part of computing AccessibilityObject::ignoredFromModalPresence. One
     14    example of such a cycle:
     15   
     16    AXObjectCache::currentModalNode() ->
     17    AccessibilityRenderObject::computeAccessibilityIsIgnored() ->
     18    AccessibilityRenderObject::parentObjectUnignored() ->
     19    AccessibilityObject::accessibilityIsIgnored() ->
     20    AccessibilityObject::ignoredFromModalPresence() ->
     21    AXObjectCache::currentModalNode() ->
     22    ...repeat...
     23   
     24    This patch fixes this by tracking when we start computing the current
     25    modal node in the AXObjectCache. Then, in AccessibilityObject::accessibilityIsIgnored(),
     26    we don't call AccessibilityObject::ignoredFromModalPresence() if this new state is true,
     27    since in this context we only need to know if the object is inherently
     28    ignored (i.e. ignored disregarding modal presence).
     29   
     30    Test: accessibility/aria-modal-with-text-crash.html
     31   
     32    * accessibility/AXObjectCache.cpp:
     33    (WebCore::AXObjectCache::currentModalNode):
     34    * accessibility/AXObjectCache.h:
     35    Add m_isRetrievingCurrentModalNode.
     36    (WebCore::AXObjectCache::isRetrievingCurrentModalNode): Added.
     37    * accessibility/AccessibilityObject.cpp:
     38    (WebCore::AccessibilityObject::accessibilityIsIgnored const):
     39    Don't call ignoredFromModalPresence if we're in the midst of computing the current modal.
     40   
     41    LayoutTests:
     42   
     43    * accessibility/aria-modal-with-text-crash-expected.txt: Added.
     44    * accessibility/aria-modal-with-text-crash.html: Added.
     45    * platform/glib/TestExpectations: Skip new test.
     46    * platform/ios/TestExpectations: Enable new test.
     47    * platform/win/TestExpectations: Skip new test.
     48   
     49   
     50    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@294186 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     51
     52    2022-05-13  Tyler Wilcock  <tyler_w@apple.com>
     53
     54            Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
     55            https://bugs.webkit.org/show_bug.cgi?id=240365
     56
     57            Reviewed by Chris Fleizach.
     58
     59            * accessibility/aria-modal-with-text-crash-expected.txt: Added.
     60            * accessibility/aria-modal-with-text-crash.html: Added.
     61            * platform/glib/TestExpectations: Skip new test.
     62            * platform/ios/TestExpectations: Enable new test.
     63            * platform/win/TestExpectations: Skip new test.
     64
    1652022-05-12  Russell Epstein  <repstein@apple.com>
    266

  • branches/safari-7614.1.14.1-branch/LayoutTests/platform/glib/TestExpectations

    r293771 r294739  
    352352
    353353# Missing AccessibilityUIElement::uiElementForSearchPredicate implementation.
     354accessibility/aria-modal-with-text-crash.html [ Skip ]
    354355accessibility/display-contents-search-traversal.html [ Skip ]
    355356accessibility/search-traversal-after-role-change.html [ Skip ]

  • branches/safari-7614.1.14.1-branch/LayoutTests/platform/ios/TestExpectations

    r293927 r294739  
    21362136webkit.org/b/150366 accessibility/aria-table-attributes.html [ Pass ]
    21372137
     2138accessibility/aria-modal-with-text-crash.html [ Pass ]
    21382139accessibility/display-contents-search-traversal.html [ Pass ]
    21392140accessibility/search-traversal-after-role-change.html [ Pass ]

  • branches/safari-7614.1.14.1-branch/LayoutTests/platform/win/TestExpectations

    r293345 r294739  
    484484
    485485# Missing AccessibilityUIElement::uiElementForSearchPredicate implementation.
     486accessibility/aria-modal-with-text-crash.html [ Skip ]
    486487accessibility/display-contents-search-traversal.html [ Skip ]
    487488accessibility/search-traversal-after-role-change.html [ Skip ]

  • branches/safari-7614.1.14.1-branch/Source/WebCore/ChangeLog

    r294308 r294739  
     12022-05-23  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r294186. rdar://problem/93805727
     4
     5    Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
     6    https://bugs.webkit.org/show_bug.cgi?id=240365
     7   
     8    Reviewed by Chris Fleizach.
     9   
     10    Source/WebCore:
     11   
     12    We can get infinite recursion when accessibilityIsIgnored is called as
     13    part of computing AccessibilityObject::ignoredFromModalPresence. One
     14    example of such a cycle:
     15   
     16    AXObjectCache::currentModalNode() ->
     17    AccessibilityRenderObject::computeAccessibilityIsIgnored() ->
     18    AccessibilityRenderObject::parentObjectUnignored() ->
     19    AccessibilityObject::accessibilityIsIgnored() ->
     20    AccessibilityObject::ignoredFromModalPresence() ->
     21    AXObjectCache::currentModalNode() ->
     22    ...repeat...
     23   
     24    This patch fixes this by tracking when we start computing the current
     25    modal node in the AXObjectCache. Then, in AccessibilityObject::accessibilityIsIgnored(),
     26    we don't call AccessibilityObject::ignoredFromModalPresence() if this new state is true,
     27    since in this context we only need to know if the object is inherently
     28    ignored (i.e. ignored disregarding modal presence).
     29   
     30    Test: accessibility/aria-modal-with-text-crash.html
     31   
     32    * accessibility/AXObjectCache.cpp:
     33    (WebCore::AXObjectCache::currentModalNode):
     34    * accessibility/AXObjectCache.h:
     35    Add m_isRetrievingCurrentModalNode.
     36    (WebCore::AXObjectCache::isRetrievingCurrentModalNode): Added.
     37    * accessibility/AccessibilityObject.cpp:
     38    (WebCore::AccessibilityObject::accessibilityIsIgnored const):
     39    Don't call ignoredFromModalPresence if we're in the midst of computing the current modal.
     40   
     41    LayoutTests:
     42   
     43    * accessibility/aria-modal-with-text-crash-expected.txt: Added.
     44    * accessibility/aria-modal-with-text-crash.html: Added.
     45    * platform/glib/TestExpectations: Skip new test.
     46    * platform/ios/TestExpectations: Enable new test.
     47    * platform/win/TestExpectations: Skip new test.
     48   
     49   
     50    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@294186 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     51
     52    2022-05-13  Tyler Wilcock  <tyler_w@apple.com>
     53
     54            Infinite recursion caused by call to accessibilityIsIgnored in the midst of AccessibilityObject::ignoredFromModalPresence
     55            https://bugs.webkit.org/show_bug.cgi?id=240365
     56
     57            Reviewed by Chris Fleizach.
     58
     59            We can get infinite recursion when accessibilityIsIgnored is called as
     60            part of computing AccessibilityObject::ignoredFromModalPresence. One
     61            example of such a cycle:
     62
     63            AXObjectCache::currentModalNode() ->
     64            AccessibilityRenderObject::computeAccessibilityIsIgnored() ->
     65            AccessibilityRenderObject::parentObjectUnignored() ->
     66            AccessibilityObject::accessibilityIsIgnored() ->
     67            AccessibilityObject::ignoredFromModalPresence() ->
     68            AXObjectCache::currentModalNode() ->
     69            ...repeat...
     70
     71            This patch fixes this by tracking when we start computing the current
     72            modal node in the AXObjectCache. Then, in AccessibilityObject::accessibilityIsIgnored(),
     73            we don't call AccessibilityObject::ignoredFromModalPresence() if this new state is true,
     74            since in this context we only need to know if the object is inherently
     75            ignored (i.e. ignored disregarding modal presence).
     76
     77            Test: accessibility/aria-modal-with-text-crash.html
     78
     79            * accessibility/AXObjectCache.cpp:
     80            (WebCore::AXObjectCache::currentModalNode):
     81            * accessibility/AXObjectCache.h:
     82            Add m_isRetrievingCurrentModalNode.
     83            (WebCore::AXObjectCache::isRetrievingCurrentModalNode): Added.
     84            * accessibility/AccessibilityObject.cpp:
     85            (WebCore::AccessibilityObject::accessibilityIsIgnored const):
     86            Don't call ignoredFromModalPresence if we're in the midst of computing the current modal.
     87
    1882022-05-16  Russell Epstein  <repstein@apple.com>
    289

  • branches/safari-7614.1.14.1-branch/Source/WebCore/accessibility/AXObjectCache.cpp

    r293566 r294739  
    307307    }
    308308
     309    SetForScope retrievingCurrentModalNode(m_isRetrievingCurrentModalNode, true);
    309310    // If any of the modal nodes contains the keyboard focus, we want to pick that one.
    310311    // If not, we want to pick the last visible dialog in the DOM.

  • branches/safari-7614.1.14.1-branch/Source/WebCore/accessibility/AXObjectCache.h

    r293566 r294739  
    200200    void handleScrolledToAnchor(const Node* anchorNode);
    201201    void handleScrollbarUpdate(ScrollView*);
    202    
     202
     203    bool isRetrievingCurrentModalNode() { return m_isRetrievingCurrentModalNode; }
    203204    Node* modalNode();
    204205
    … …  
    517518    ListHashSet<Element*> m_modalElementsSet;
    518519    bool m_modalNodesInitialized { false };
     520    bool m_isRetrievingCurrentModalNode { false };
    519521
    520522    Timer m_performCacheUpdateTimer;

  • branches/safari-7614.1.14.1-branch/Source/WebCore/accessibility/AccessibilityObject.cpp

    r293650 r294739  
    37473747    }
    37483748
    3749     bool ignored = ignoredFromModalPresence();
     3749    // If we are in the midst of retrieving the current modal node, we only need to consider whether the object
     3750    // is inherently ignored via computeAccessibilityIsIgnored. Also, calling ignoredFromModalPresence
     3751    // in this state would cause infinite recursion.
     3752    bool ignored = cache && cache->isRetrievingCurrentModalNode() ? false : ignoredFromModalPresence();
    37503753    if (!ignored)
    37513754        ignored = computeAccessibilityIsIgnored();
Note: See TracChangeset for help on using the changeset viewer.