Changeset 140340 in webkit

Timestamp:

Jan 21, 2013 8:57:38 AM (11 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in AccessibilityTableCell::parentTable()
​https://bugs.webkit.org/show_bug.cgi?id=107261

Patch by Joanmarie Diggs <​jdiggs@igalia.com> on 2013-01-21
Reviewed by Chris Fleizach.

Source/WebCore:

Test: accessibility/table-destroyed-crash.html

Getting the parent table in order to get the role value should not be
done when objects are being destroyed. Also, it does not seem safe to
assume we have an AXObjectCache.

Moving the logic from roleValue() to determineAccessibilityRole() has
the side effect of not being able to verify the cell is in an AXTable
when that AXTable has not yet been created. Therefore isTableCell()
should look to see if it is the descendant of an AXRow.

• accessibility/AccessibilityTableCell.cpp:

(WebCore::AccessibilityTableCell::parentTable):
(WebCore::AccessibilityTableCell::isTableCell):
(WebCore::AccessibilityTableCell::determineAccessibilityRole):

• accessibility/AccessibilityTableCell.h:

(AccessibilityTableCell):

LayoutTests:

Getting the parent table in order to get the role value should not be
done when objects are being destroyed. Also, it does not seem safe to
assume we have an AXObjectCache.

• accessibility/table-destroyed-crash-expected.txt: Added.
• accessibility/table-destroyed-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/accessibility/table-destroyed-crash-expected.txt (added)
• LayoutTests/accessibility/table-destroyed-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/accessibility/AccessibilityTableCell.cpp (modified) (3 diffs)
• Source/WebCore/accessibility/AccessibilityTableCell.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-01-21  Joanmarie Diggs  <jdiggs@igalia.com>
+
+        Crash in AccessibilityTableCell::parentTable()
+        https://bugs.webkit.org/show_bug.cgi?id=107261
+
+        Reviewed by Chris Fleizach.
+
+        Getting the parent table in order to get the role value should not be
+        done when objects are being destroyed. Also, it does not seem safe to
+        assume we have an AXObjectCache.
+
+        * accessibility/table-destroyed-crash-expected.txt: Added.
+        * accessibility/table-destroyed-crash.html: Added.
+
 2013-01-21  Ádám Kallai  <kadam@inf.u-szeged.hu>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-21  Joanmarie Diggs  <jdiggs@igalia.com>
+
+        Crash in AccessibilityTableCell::parentTable()
+        https://bugs.webkit.org/show_bug.cgi?id=107261
+
+        Reviewed by Chris Fleizach.
+
+        Test: accessibility/table-destroyed-crash.html
+
+        Getting the parent table in order to get the role value should not be
+        done when objects are being destroyed. Also, it does not seem safe to
+        assume we have an AXObjectCache.
+
+        Moving the logic from roleValue() to determineAccessibilityRole() has
+        the side effect of not being able to verify the cell is in an AXTable
+        when that AXTable has not yet been created. Therefore isTableCell()
+        should look to see if it is the descendant of an AXRow.
+
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::determineAccessibilityRole):
+        * accessibility/AccessibilityTableCell.h:
+        (AccessibilityTableCell):
+
 2013-01-21  Halton Huo  <halton.huo@intel.com>
 

trunk/Source/WebCore/accessibility/AccessibilityTableCell.cpp

@@ -75 +75 @@
     if (!m_renderer || !m_renderer->isTableCell())
         return 0;
+
+    // If the document no longer exists, we might not have an axObjectCache.
+    if (!axObjectCache())
+        return 0;
     
     // Do not use getOrCreate. parentTable() can be called while the render tree is being modified 
@@ -86 +90 @@
 bool AccessibilityTableCell::isTableCell() const
 {
-    AccessibilityObject* table = parentTable();
-    if (!table || !table->isAccessibilityTable())
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
         return false;
     
@@ -93 +97 @@
 }
     
-AccessibilityRole AccessibilityTableCell::roleValue() const
+AccessibilityRole AccessibilityTableCell::determineAccessibilityRole()
 {
     if (!isTableCell())
-        return AccessibilityRenderObject::roleValue();
+        return AccessibilityRenderObject::determineAccessibilityRole();
     
     return CellRole;

trunk/Source/WebCore/accessibility/AccessibilityTableCell.h

@@ -43 +43 @@
     
     virtual bool isTableCell() const;
-    virtual AccessibilityRole roleValue() const;
     
     virtual bool accessibilityIsIgnored() const;
@@ -55 +54 @@
     virtual AccessibilityObject* parentTable() const;
     int m_rowIndex;
+    virtual AccessibilityRole determineAccessibilityRole();
 
 private: