Changeset 140658 in webkit


Ignore:
Timestamp:
Jan 24, 2013 12:16:00 AM (11 years ago)
Author:
dmazzoni@google.com
Message:

AX: should init an AXObject only after AXObjectCache has added it
​https://bugs.webkit.org/show_bug.cgi?id=107533

Reviewed by Chris Fleizach.

Source/WebCore:

Initialize each AXObject after the AXObjectCache has
finished adding it to its hash maps, so that it's
impossible for initialization of an AXObject to result in
exploring the tree and creating another AXObject instance
that points to the same renderer / node.

Test: accessibility/duplicate-axrenderobject-crash.html

  • accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::getOrCreate):

  • accessibility/AccessibilityARIAGrid.cpp:

(WebCore::AccessibilityARIAGrid::create):

  • accessibility/AccessibilityARIAGridCell.cpp:

(WebCore::AccessibilityARIAGridCell::create):

  • accessibility/AccessibilityARIAGridRow.cpp:

(WebCore::AccessibilityARIAGridRow::create):

  • accessibility/AccessibilityList.cpp:

(WebCore::AccessibilityList::create):

  • accessibility/AccessibilityListBox.cpp:

(WebCore::AccessibilityListBox::create):

  • accessibility/AccessibilityMediaControls.cpp:

(WebCore::AccessibilityMediaControl::create):
(WebCore::AccessibilityMediaControlsContainer::create):
(WebCore::AccessibilityMediaTimeline::create):
(WebCore::AccessibilityMediaTimeDisplay::create):

  • accessibility/AccessibilityMenuList.cpp:

(WebCore::AccessibilityMenuList::create):

  • accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::create):

  • accessibility/AccessibilityObject.h:

(WebCore::AccessibilityObject::init):
(AccessibilityObject):

  • accessibility/AccessibilityProgressIndicator.cpp:

(WebCore::AccessibilityProgressIndicator::create):

  • accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::create):
(WebCore::AccessibilityRenderObject::accessibilityIsIgnored):

assert that the object has been initialized

  • accessibility/AccessibilitySVGRoot.cpp:

(WebCore::AccessibilitySVGRoot::create):

  • accessibility/AccessibilitySlider.cpp:

(WebCore::AccessibilitySlider::create):

  • accessibility/AccessibilityTable.cpp:

(WebCore::AccessibilityTable::create):

  • accessibility/AccessibilityTableCell.cpp:

(WebCore::AccessibilityTableCell::create):

  • accessibility/AccessibilityTableRow.cpp:

(WebCore::AccessibilityTableRow::create):

LayoutTests:

Adds a new test that demonstrates a crash if an AXObject
initializes itself before the AXObjectCache has added it to
the cache.

  • accessibility/duplicate-axrenderobject-crash-expected.txt: Added.
  • accessibility/duplicate-axrenderobject-crash.html: Added.
Location:
trunk
Files:
2 added
20 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r140657 r140658  
     12013-01-24  Dominic Mazzoni  <dmazzoni@google.com>
     2
     3        AX: should init an AXObject only after AXObjectCache has added it
     4        https://bugs.webkit.org/show_bug.cgi?id=107533
     5
     6        Reviewed by Chris Fleizach.
     7
     8        Adds a new test that demonstrates a crash if an AXObject
     9        initializes itself before the AXObjectCache has added it to
     10        the cache.
     11
     12        * accessibility/duplicate-axrenderobject-crash-expected.txt: Added.
     13        * accessibility/duplicate-axrenderobject-crash.html: Added.
     14
    1152013-01-23  Kentaro Hara  <haraken@chromium.org>
    216

  • trunk/Source/WebCore/ChangeLog

    r140657 r140658  
     12013-01-24  Dominic Mazzoni  <dmazzoni@google.com>
     2
     3        AX: should init an AXObject only after AXObjectCache has added it
     4        https://bugs.webkit.org/show_bug.cgi?id=107533
     5
     6        Reviewed by Chris Fleizach.
     7
     8        Initialize each AXObject after the AXObjectCache has
     9        finished adding it to its hash maps, so that it's
     10        impossible for initialization of an AXObject to result in
     11        exploring the tree and creating another AXObject instance
     12        that points to the same renderer / node.
     13
     14        Test: accessibility/duplicate-axrenderobject-crash.html
     15
     16        * accessibility/AXObjectCache.cpp:
     17        (WebCore::AXObjectCache::getOrCreate):
     18        * accessibility/AccessibilityARIAGrid.cpp:
     19        (WebCore::AccessibilityARIAGrid::create):
     20        * accessibility/AccessibilityARIAGridCell.cpp:
     21        (WebCore::AccessibilityARIAGridCell::create):
     22        * accessibility/AccessibilityARIAGridRow.cpp:
     23        (WebCore::AccessibilityARIAGridRow::create):
     24        * accessibility/AccessibilityList.cpp:
     25        (WebCore::AccessibilityList::create):
     26        * accessibility/AccessibilityListBox.cpp:
     27        (WebCore::AccessibilityListBox::create):
     28        * accessibility/AccessibilityMediaControls.cpp:
     29        (WebCore::AccessibilityMediaControl::create):
     30        (WebCore::AccessibilityMediaControlsContainer::create):
     31        (WebCore::AccessibilityMediaTimeline::create):
     32        (WebCore::AccessibilityMediaTimeDisplay::create):
     33        * accessibility/AccessibilityMenuList.cpp:
     34        (WebCore::AccessibilityMenuList::create):
     35        * accessibility/AccessibilityNodeObject.cpp:
     36        (WebCore::AccessibilityNodeObject::create):
     37        * accessibility/AccessibilityObject.h:
     38        (WebCore::AccessibilityObject::init):
     39        (AccessibilityObject):
     40        * accessibility/AccessibilityProgressIndicator.cpp:
     41        (WebCore::AccessibilityProgressIndicator::create):
     42        * accessibility/AccessibilityRenderObject.cpp:
     43        (WebCore::AccessibilityRenderObject::create):
     44        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
     45            assert that the object has been initialized
     46        * accessibility/AccessibilitySVGRoot.cpp:
     47        (WebCore::AccessibilitySVGRoot::create):
     48        * accessibility/AccessibilitySlider.cpp:
     49        (WebCore::AccessibilitySlider::create):
     50        * accessibility/AccessibilityTable.cpp:
     51        (WebCore::AccessibilityTable::create):
     52        * accessibility/AccessibilityTableCell.cpp:
     53        (WebCore::AccessibilityTableCell::create):
     54        * accessibility/AccessibilityTableRow.cpp:
     55        (WebCore::AccessibilityTableRow::create):
     56
    1572013-01-23  Kentaro Hara  <haraken@chromium.org>
    258

  • trunk/Source/WebCore/accessibility/AXObjectCache.cpp

    r140393 r140658  
    315315    m_objects.set(newObj->axObjectID(), newObj);   
    316316    attachWrapper(newObj.get());
     317    newObj->init();
    317318    return newObj.get();
    318319}
    … …  
    350351    attachWrapper(newObj.get());
    351352
     353    newObj->init();
    352354    newObj->setCachedIsIgnoredValue(newObj->accessibilityIsIgnored());
    353355
    … …  
    374376    attachWrapper(newObj.get());
    375377
     378    newObj->init();
    376379    newObj->setCachedIsIgnoredValue(newObj->accessibilityIsIgnored());
    377380
    … …  
    441444    m_objects.set(obj->axObjectID(), obj);   
    442445    attachWrapper(obj.get());
     446    obj->init();
    443447    return obj.get();
    444448}

  • trunk/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp

    r131957 r140658  
    6262PassRefPtr<AccessibilityARIAGrid> AccessibilityARIAGrid::create(RenderObject* renderer)
    6363{
    64     AccessibilityARIAGrid* obj = new AccessibilityARIAGrid(renderer);
    65     obj->init();
    66     return adoptRef(obj);
     64    return adoptRef(new AccessibilityARIAGrid(renderer));
    6765}
    6866

  • trunk/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp

    r123428 r140658  
    4949PassRefPtr<AccessibilityARIAGridCell> AccessibilityARIAGridCell::create(RenderObject* renderer)
    5050{
    51     AccessibilityARIAGridCell* obj = new AccessibilityARIAGridCell(renderer);
    52     obj->init();
    53     return adoptRef(obj);
     51    return adoptRef(new AccessibilityARIAGridCell(renderer));
    5452}
    5553

  • trunk/Source/WebCore/accessibility/AccessibilityARIAGridRow.cpp

    r140095 r140658  
    4949PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObject* renderer)
    5050{
    51     AccessibilityARIAGridRow* obj = new AccessibilityARIAGridRow(renderer);
    52     obj->init();
    53     return adoptRef(obj);
     51    return adoptRef(new AccessibilityARIAGridRow(renderer));
    5452}
    5553

  • trunk/Source/WebCore/accessibility/AccessibilityList.cpp

    r123428 r140658  
    5151PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
    5252{
    53     AccessibilityList* obj = new AccessibilityList(renderer);
    54     obj->init();
    55     return adoptRef(obj);
     53    return adoptRef(new AccessibilityList(renderer));
    5654}
    5755

  • trunk/Source/WebCore/accessibility/AccessibilityListBox.cpp

    r123428 r140658  
    5555PassRefPtr<AccessibilityListBox> AccessibilityListBox::create(RenderObject* renderer)
    5656{
    57     AccessibilityListBox* obj = new AccessibilityListBox(renderer);
    58     obj->init();
    59     return adoptRef(obj);
     57    return adoptRef(new AccessibilityListBox(renderer));
    6058}
    6159   

  • trunk/Source/WebCore/accessibility/AccessibilityMediaControls.cpp

    r133424 r140658  
    6868        return AccessibilityMediaControlsContainer::create(renderer);
    6969
    70     default: {
    71         AccessibilityMediaControl* obj = new AccessibilityMediaControl(renderer);
    72         obj->init();
    73         return adoptRef(obj);
    74         }
     70    default:
     71        return adoptRef(new AccessibilityMediaControl(renderer));
    7572    }
    7673}
    … …  
    227224PassRefPtr<AccessibilityObject> AccessibilityMediaControlsContainer::create(RenderObject* renderer)
    228225{
    229     AccessibilityMediaControlsContainer* obj = new AccessibilityMediaControlsContainer(renderer);
    230     obj->init();
    231     return adoptRef(obj);
     226    return adoptRef(new AccessibilityMediaControlsContainer(renderer));
    232227}
    233228
    … …  
    273268PassRefPtr<AccessibilityObject> AccessibilityMediaTimeline::create(RenderObject* renderer)
    274269{
    275     AccessibilityMediaTimeline* obj = new AccessibilityMediaTimeline(renderer);
    276     obj->init();
    277     return adoptRef(obj);
     270    return adoptRef(new AccessibilityMediaTimeline(renderer));
    278271}
    279272
    … …  
    305298PassRefPtr<AccessibilityObject> AccessibilityMediaTimeDisplay::create(RenderObject* renderer)
    306299{
    307     AccessibilityMediaTimeDisplay* obj = new AccessibilityMediaTimeDisplay(renderer);
    308     obj->init();
    309     return adoptRef(obj);
     300    return adoptRef(new AccessibilityMediaTimeDisplay(renderer));
    310301}
    311302

  • trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp

    r123428 r140658  
    4040PassRefPtr<AccessibilityMenuList> AccessibilityMenuList::create(RenderMenuList* renderer)
    4141{
    42     AccessibilityMenuList* obj = new AccessibilityMenuList(renderer);
    43     obj->init();
    44     return adoptRef(obj);
     42    return adoptRef(new AccessibilityMenuList(renderer));
    4543}
    4644

  • trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp

    r139663 r140658  
    9090    , m_roleForMSAA(UnknownRole)
    9191    , m_node(node)
     92#ifndef NDEBUG
     93    , m_initialized(false)
     94#endif
    9295{
    9396}
    … …  
    100103void AccessibilityNodeObject::init()
    101104{
     105#ifndef NDEBUG
     106    ASSERT(!m_initialized);
     107    m_initialized = true;
     108#endif
    102109    m_role = determineAccessibilityRole();
    103110}
    … …  
    105112PassRefPtr<AccessibilityNodeObject> AccessibilityNodeObject::create(Node* node)
    106113{
    107     AccessibilityNodeObject* obj = new AccessibilityNodeObject(node);
    108     obj->init();
    109     return adoptRef(obj);
     114    return adoptRef(new AccessibilityNodeObject(node));
    110115}
    111116
    … …  
    387392bool AccessibilityNodeObject::accessibilityIsIgnored() const
    388393{
     394#ifndef NDEBUG
     395    // Double-check that an AccessibilityObject is never accessed before
     396    // it's been initialized.
     397    ASSERT(m_initialized);
     398#endif
     399
    389400    // If this element is within a parent that cannot have children, it should not be exposed.
    390401    if (isDescendantOfBarrenParent())

  • trunk/Source/WebCore/accessibility/AccessibilityNodeObject.h

    r139663 r140658  
    154154    bool m_childrenDirty;
    155155    mutable AccessibilityRole m_roleForMSAA;
     156#ifndef NDEBUG
     157    bool m_initialized;
     158#endif
    156159
    157160    virtual bool isDetached() const { return !m_node; }

  • trunk/Source/WebCore/accessibility/AccessibilityObject.h

    r139663 r140658  
    356356public:
    357357    virtual ~AccessibilityObject();
     358
     359    // After constructing an AccessibilityObject, it must be given a
     360    // unique ID, then added to AXObjectCache, and finally init() must
     361    // be called last.
     362    void setAXObjectID(AXID axObjectID) { m_id = axObjectID; }
     363    virtual void init() { }
     364
     365    // When the corresponding WebCore object that this AccessibilityObject
     366    // wraps is deleted, it must be detached.
    358367    virtual void detach();
    359368    virtual bool isDetached() const;
    … …  
    570579    virtual AXObjectCache* axObjectCache() const;
    571580    AXID axObjectID() const { return m_id; }
    572     void setAXObjectID(AXID axObjectID) { m_id = axObjectID; }
    573581   
    574582    static AccessibilityObject* anchorElementForNode(Node*);

  • trunk/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp

    r123428 r140658  
    4040PassRefPtr<AccessibilityProgressIndicator> AccessibilityProgressIndicator::create(RenderProgress* renderer)
    4141{
    42     AccessibilityProgressIndicator* obj = new AccessibilityProgressIndicator(renderer);
    43     obj->init();
    44     return adoptRef(obj);
     42    return adoptRef(new AccessibilityProgressIndicator(renderer));
    4543}
    4644

  • trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp

    r140541 r140658  
    124124PassRefPtr<AccessibilityRenderObject> AccessibilityRenderObject::create(RenderObject* renderer)
    125125{
    126     AccessibilityRenderObject* obj = new AccessibilityRenderObject(renderer);
    127     obj->init();
    128     return adoptRef(obj);
     126    return adoptRef(new AccessibilityRenderObject(renderer));
    129127}
    130128
    … …  
    11271125bool AccessibilityRenderObject::accessibilityIsIgnored() const
    11281126{
     1127#ifndef NDEBUG
     1128    ASSERT(m_initialized);
     1129#endif
     1130
    11291131    // Check first if any of the common reasons cause this element to be ignored.
    11301132    // Then process other use cases that need to be applied to all the various roles

  • trunk/Source/WebCore/accessibility/AccessibilitySVGRoot.cpp

    r132915 r140658  
    4646PassRefPtr<AccessibilitySVGRoot> AccessibilitySVGRoot::create(RenderObject* renderer)
    4747{
    48     AccessibilitySVGRoot* obj = new AccessibilitySVGRoot(renderer);
    49     obj->init();
    50     return adoptRef(obj);
     48    return adoptRef(new AccessibilitySVGRoot(renderer));
    5149}
    5250   

  • trunk/Source/WebCore/accessibility/AccessibilitySlider.cpp

    r128006 r140658  
    4848PassRefPtr<AccessibilitySlider> AccessibilitySlider::create(RenderObject* renderer)
    4949{
    50     AccessibilitySlider* obj = new AccessibilitySlider(renderer);
    51     obj->init();
    52     return adoptRef(obj);
     50    return adoptRef(new AccessibilitySlider(renderer));
    5351}
    5452

  • trunk/Source/WebCore/accessibility/AccessibilityTable.cpp

    r140181 r140658  
    7070PassRefPtr<AccessibilityTable> AccessibilityTable::create(RenderObject* renderer)
    7171{
    72     AccessibilityTable* obj = new AccessibilityTable(renderer);
    73     obj->init();
    74     return adoptRef(obj);
     72    return adoptRef(new AccessibilityTable(renderer));
    7573}
    7674

  • trunk/Source/WebCore/accessibility/AccessibilityTableCell.cpp

    r140340 r140658  
    5252PassRefPtr<AccessibilityTableCell> AccessibilityTableCell::create(RenderObject* renderer)
    5353{
    54     AccessibilityTableCell* obj = new AccessibilityTableCell(renderer);
    55     obj->init();
    56     return adoptRef(obj);
     54    return adoptRef(new AccessibilityTableCell(renderer));
    5755}
    5856

  • trunk/Source/WebCore/accessibility/AccessibilityTableRow.cpp

    r140095 r140658  
    5555PassRefPtr<AccessibilityTableRow> AccessibilityTableRow::create(RenderObject* renderer)
    5656{
    57     AccessibilityTableRow* obj = new AccessibilityTableRow(renderer);
    58     obj->init();
    59     return adoptRef(obj);
     57    return adoptRef(new AccessibilityTableRow(renderer));
    6058}
    6159
Note: See TracChangeset for help on using the changeset viewer.