Changeset 124997 in webkit

Timestamp:

Aug 7, 2012 11:47:46 PM (12 years ago)

Author:

mario@webkit.org

Message:

REGRESSION(r65062): out of bound access in TextIterator (5 editing tests) on GTK
​https://bugs.webkit.org/show_bug.cgi?id=63611

Reviewed by Ryosuke Niwa.

Ensure document's layout is up-to-date before using TextIterator
to properly calculate the offset for a text change when emitting
accessibility related signals in GTK.

• accessibility/gtk/AXObjectCacheAtk.cpp:

(WebCore::AXObjectCache::nodeTextChangePlatformNotification): Call
to document->updateLayout() before using TextIterator.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• accessibility/gtk/AXObjectCacheAtk.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-08-08  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        REGRESSION(r65062): out of bound access in TextIterator (5 editing tests) on GTK
+        https://bugs.webkit.org/show_bug.cgi?id=63611
+
+        Reviewed by Ryosuke Niwa.
+
+        Ensure document's layout is up-to-date before using TextIterator
+        to properly calculate the offset for a text change when emitting
+        accessibility related signals in GTK.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::nodeTextChangePlatformNotification): Call
+        to document->updateLayout() before using TextIterator.
+
 2012-08-07  Hayato Ito  <hayato@chromium.org>
 

trunk/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp

@@ -186 +186 @@
 
     Node* node = object->node();
-    RefPtr<Range> range = Range::create(node->document(), node->parentNode(), 0, node, 0);
+    if (!node)
+        return;
+
+    // Ensure document's layout is up-to-date before using TextIterator.
+    Document* document = node->document();
+    document->updateLayout();
+
+    RefPtr<Range> range = Range::create(document, node->parentNode(), 0, node, 0);
     emitTextChanged(object, textChange, offset + TextIterator::rangeLength(range.get()), text);
 }