Changeset 48521 in webkit


Ignore:
Timestamp:
Sep 18, 2009, 12:00:28 PM (16 years ago)
Author:
mitz@apple.com
Message:

WebCore: Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
WebCore::RenderBlock::layoutBlock()
​https://bugs.webkit.org/show_bug.cgi?id=29498

Reviewed by Darin Adler.

Test: accessibility/nested-layout-crash.html

  • accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::updateBackingStore): Changed to

call Document::updateLayoutIgnorePendingStylesheets() instead of
calling RenderObject::layoutIfNeeded(). The latter requires that
there be no pending style recalc, which allows methods that call
Document::updateLayout() to be called during layout without risking
re-entry into layout.

  • accessibility/mac/AccessibilityObjectWrapper.mm:

(-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check

m_object after calling updateBackingStore(), since style recalc may
destroy the renderer, which destroys the accessibility object and
detaches it from the wrapper.

(-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
(-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
(-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
(-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
(-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):

Ditto.

(-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
(-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):

Ditto.

(-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
(-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):

Ditto.

(-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):

Ditto.

(-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
(-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):

Ditto.

(-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

Ditto.

(-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
(-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):

Ditto.

(-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):

Ditto.

LayoutTests: Test for <rdar://problem/7050773> REGRESSION (r40098) Crash at
WebCore::RenderBlock::layoutBlock()
​https://bugs.webkit.org/show_bug.cgi?id=29498

Reviewed by Darin Adler.

  • accessibility/nested-layout-crash-expected.txt: Added.
  • accessibility/nested-layout-crash.html: Added.
Location:
trunk
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r48515 r48521  
     12009-09-18  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        Test for <rdar://problem/7050773> REGRESSION (r40098) Crash at
     6        WebCore::RenderBlock::layoutBlock()
     7        https://bugs.webkit.org/show_bug.cgi?id=29498
     8
     9        * accessibility/nested-layout-crash-expected.txt: Added.
     10        * accessibility/nested-layout-crash.html: Added.
     11
    1122009-09-18  Sam Weinig  <sam@webkit.org>
    213

  • trunk/WebCore/ChangeLog

    r48520 r48521  
     12009-09-18  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
     6        WebCore::RenderBlock::layoutBlock()
     7        https://bugs.webkit.org/show_bug.cgi?id=29498
     8
     9        Test: accessibility/nested-layout-crash.html
     10
     11        * accessibility/AccessibilityRenderObject.cpp:
     12        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
     13            call Document::updateLayoutIgnorePendingStylesheets() instead of
     14            calling RenderObject::layoutIfNeeded(). The latter requires that
     15            there be no pending style recalc, which allows methods that call
     16            Document::updateLayout() to be called during layout without risking
     17            re-entry into layout.
     18        * accessibility/mac/AccessibilityObjectWrapper.mm:
     19        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
     20            m_object after calling updateBackingStore(), since style recalc may
     21            destroy the renderer, which destroys the accessibility object and
     22            detaches it from the wrapper.
     23        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
     24        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
     25        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
     26        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
     27        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
     28            Ditto.
     29        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
     30        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
     31             Ditto.
     32        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
     33        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
     34            Ditto.
     35        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
     36            Ditto.
     37        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
     38        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
     39            Ditto.
     40        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
     41            Ditto.
     42        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
     43        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
     44            Ditto.
     45        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
     46            Ditto.
     47
    1482009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
    249

  • trunk/WebCore/accessibility/AccessibilityRenderObject.cpp

    r48482 r48521  
    26772677    if (!m_renderer)
    26782678        return;
    2679     m_renderer->view()->layoutIfNeeded();
    2680 }   
    2681    
     2679
     2680    // Updating layout may delete m_renderer and this object.
     2681    m_renderer->document()->updateLayoutIgnorePendingStylesheets();
     2682}
     2683
    26822684} // namespace WebCore

  • trunk/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm

    r47763 r48521  
    547547
    548548    m_object->updateBackingStore();
     549    if (!m_object)
     550        return nil;
    549551
    550552    static NSArray* actionElementActions = [[NSArray alloc] initWithObjects: NSAccessibilityPressAction, NSAccessibilityShowMenuAction, nil];
    … …  
    574576   
    575577    m_object->updateBackingStore();
     578    if (!m_object)
     579        return nil;
    576580   
    577581    if (m_object->isAttachment())
    … …  
    12301234
    12311235    m_object->updateBackingStore();
     1236    if (!m_object)
     1237        return nil;
    12321238   
    12331239    if ([attributeName isEqualToString: NSAccessibilityRoleAttribute])
    … …  
    15721578
    15731579    m_object->updateBackingStore();
     1580    if (!m_object)
     1581        return nil;
    15741582
    15751583    RefPtr<AccessibilityObject> focusedObj = m_object->focusedUIElement();
    … …  
    15871595
    15881596    m_object->updateBackingStore();
     1597    if (!m_object)
     1598        return nil;
    15891599
    15901600    RefPtr<AccessibilityObject> axObject = m_object->doAccessibilityHitTest(IntPoint(point));
    … …  
    16001610
    16011611    m_object->updateBackingStore();
     1612    if (!m_object)
     1613        return nil;
    16021614
    16031615    if ([attributeName isEqualToString: @"AXSelectedTextMarkerRange"])
    … …  
    16391651
    16401652    m_object->updateBackingStore();
     1653    if (!m_object)
     1654        return nil;
    16411655
    16421656    if (m_object->isAttachment())
    … …  
    16511665
    16521666    m_object->updateBackingStore();
     1667    if (!m_object)
     1668        return nil;
    16531669
    16541670    if (m_object->isAttachment())
    … …  
    17371753
    17381754    m_object->updateBackingStore();
     1755    if (!m_object)
     1756        return;
    17391757
    17401758    if (m_object->isAttachment())
    … …  
    17501768
    17511769    m_object->updateBackingStore();
     1770    if (!m_object)
     1771        return;
    17521772
    17531773    if (m_object->isAttachment())
    … …  
    17631783
    17641784    m_object->updateBackingStore();
     1785    if (!m_object)
     1786        return;
    17651787
    17661788    if (m_object->isAttachment())
    … …  
    18121834
    18131835    m_object->updateBackingStore();
     1836    if (!m_object)
     1837        return;
    18141838
    18151839    if ([action isEqualToString:NSAccessibilityPressAction])
    … …  
    18321856
    18331857    m_object->updateBackingStore();
     1858    if (!m_object)
     1859        return;
    18341860
    18351861    WebCoreTextMarkerRange* textMarkerRange = nil;
    … …  
    19561982
    19571983    m_object->updateBackingStore();
     1984    if (!m_object)
     1985        return nil;
    19581986   
    19591987    // common parameter type check/casting.  Nil checks in handlers catch wrong type case.
    … …  
    22142242
    22152243    m_object->updateBackingStore();
    2216    
     2244    if (!m_object)
     2245        return NSNotFound;
     2246
    22172247    const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
    22182248       
    … …  
    22362266
    22372267    m_object->updateBackingStore();
     2268    if (!m_object)
     2269        return 0;
    22382270   
    22392271    if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
    … …  
    22542286
    22552287    m_object->updateBackingStore();
     2288    if (!m_object)
     2289        return nil;
    22562290   
    22572291    if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
Note: See TracChangeset for help on using the changeset viewer.