Changeset 163586 in webkit


Ignore:
Timestamp:
Feb 6, 2014 5:29:33 PM (10 years ago)
Author:
Chris Fleizach
Message:

AX: Crash in WebCore::AXObjectCache::computedObjectAttributeCache
​https://bugs.webkit.org/show_bug.cgi?id=128310

Reviewed by Alexey Proskuryakov.

Be more careful about using axObjectCache() directly since it can return null.
I audited the usage cases of this method and ensured the ptr was not null in cases
where I thought we might get hit by this.

  • accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::parentObject):
(WebCore::AccessibilityNodeObject::menuForMenuButton):
(WebCore::AccessibilityNodeObject::menuButtonForMenu):

  • accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
(WebCore::AccessibilityObject::findMatchingObjects):
(WebCore::AccessibilityObject::elementAccessibilityHitTest):
(WebCore::AccessibilityObject::axObjectCache):
(WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
(WebCore::AccessibilityObject::accessibilityIsIgnored):

  • accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::parentObjectIfExists):
(WebCore::AccessibilityRenderObject::parentObject):
(WebCore::AccessibilityRenderObject::anchorElement):
(WebCore::AccessibilityRenderObject::isTabItemSelected):
(WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
(WebCore::AccessibilityRenderObject::nodeIsTextControl):
(WebCore::AccessibilityRenderObject::activeDescendant):
(WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):
(WebCore::AccessibilityRenderObject::observableObject):
(WebCore::AccessibilityRenderObject::textChanged):

  • accessibility/AccessibilityScrollView.cpp:

(WebCore::AccessibilityScrollView::addChildScrollbar):
(WebCore::AccessibilityScrollView::webAreaObject):
(WebCore::AccessibilityScrollView::parentObject):
(WebCore::AccessibilityScrollView::parentObjectIfExists):

Location:
trunk/Source/WebCore
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r163585 r163586  
     12014-02-06  Chris Fleizach  <cfleizach@apple.com>
     2
     3        AX: Crash in WebCore::AXObjectCache::computedObjectAttributeCache
     4        https://bugs.webkit.org/show_bug.cgi?id=128310
     5
     6        Reviewed by Alexey Proskuryakov.
     7
     8        Be more careful about using axObjectCache() directly since it can return null.
     9        I audited the usage cases of this method and ensured the ptr was not null in cases
     10        where I thought we might get hit by this.
     11
     12        * accessibility/AccessibilityNodeObject.cpp:
     13        (WebCore::AccessibilityNodeObject::parentObject):
     14        (WebCore::AccessibilityNodeObject::menuForMenuButton):
     15        (WebCore::AccessibilityNodeObject::menuButtonForMenu):
     16        * accessibility/AccessibilityObject.cpp:
     17        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
     18        (WebCore::AccessibilityObject::findMatchingObjects):
     19        (WebCore::AccessibilityObject::elementAccessibilityHitTest):
     20        (WebCore::AccessibilityObject::axObjectCache):
     21        (WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
     22        (WebCore::AccessibilityObject::accessibilityIsIgnored):
     23        * accessibility/AccessibilityRenderObject.cpp:
     24        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
     25        (WebCore::AccessibilityRenderObject::parentObject):
     26        (WebCore::AccessibilityRenderObject::anchorElement):
     27        (WebCore::AccessibilityRenderObject::isTabItemSelected):
     28        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
     29        (WebCore::AccessibilityRenderObject::nodeIsTextControl):
     30        (WebCore::AccessibilityRenderObject::activeDescendant):
     31        (WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):
     32        (WebCore::AccessibilityRenderObject::observableObject):
     33        (WebCore::AccessibilityRenderObject::textChanged):
     34        * accessibility/AccessibilityScrollView.cpp:
     35        (WebCore::AccessibilityScrollView::addChildScrollbar):
     36        (WebCore::AccessibilityScrollView::webAreaObject):
     37        (WebCore::AccessibilityScrollView::parentObject):
     38        (WebCore::AccessibilityScrollView::parentObjectIfExists):
     39
    1402014-02-06  Zoltan Horvath  <zoltan@webkit.org>
    241

  • trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp

    r163440 r163586  
    229229
    230230    Node* parentObj = node()->parentNode();
    231     if (parentObj)
    232         return axObjectCache()->getOrCreate(parentObj);
     231    if (!parentObj)
     232        return nullptr;
     233   
     234    if (AXObjectCache* cache = axObjectCache())
     235        return cache->getOrCreate(parentObj);
    233236   
    234237    return 0;
    … …  
    12051208AccessibilityObject* AccessibilityNodeObject::menuForMenuButton() const
    12061209{
    1207     return axObjectCache()->getOrCreate(menuElementForMenuButton());
     1210    if (AXObjectCache* cache = axObjectCache())
     1211        return cache->getOrCreate(menuElementForMenuButton());
     1212    return nullptr;
    12081213}
    12091214
    … …  
    12181223AccessibilityObject* AccessibilityNodeObject::menuButtonForMenu() const
    12191224{
     1225    AXObjectCache* cache = axObjectCache();
     1226    if (!cache)
     1227        return nullptr;
     1228
    12201229    Element* menuItem = menuItemElementForMenu();
    12211230
    12221231    if (menuItem) {
    12231232        // ARIA just has generic menu items. AppKit needs to know if this is a top level items like MenuBarButton or MenuBarItem
    1224         AccessibilityObject* menuItemAX = axObjectCache()->getOrCreate(menuItem);
     1233        AccessibilityObject* menuItemAX = cache->getOrCreate(menuItem);
    12251234        if (menuItemAX && menuItemAX->isMenuButton())
    12261235            return menuItemAX;

  • trunk/Source/WebCore/accessibility/AccessibilityObject.cpp

    r163014 r163586  
    378378
    379379    AXObjectCache* cache = node->document().axObjectCache();
    380 
     380    if (!cache)
     381        return nullptr;
     382   
    381383    AccessibilityObject* accessibleObject = cache->getOrCreate(node->renderer());
    382384    while (accessibleObject && accessibleObject->accessibilityIsIgnored()) {
    … …  
    464466        return;
    465467
    466     axObjectCache()->startCachingComputedObjectAttributesUntilTreeMutates();
     468    if (AXObjectCache* cache = axObjectCache())
     469        cache->startCachingComputedObjectAttributesUntilTreeMutates();
    467470
    468471    // This search mechanism only searches the elements before/after the starting object.
    … …  
    16611664        Widget* widget = widgetForAttachmentView();
    16621665        // Normalize the point for the widget's bounds.
    1663         if (widget && widget->isFrameView())
    1664             return axObjectCache()->getOrCreate(widget)->accessibilityHitTest(IntPoint(point - widget->frameRect().location()));
     1666        if (widget && widget->isFrameView()) {
     1667            if (AXObjectCache* cache = axObjectCache())
     1668                return cache->getOrCreate(widget)->accessibilityHitTest(IntPoint(point - widget->frameRect().location()));
     1669        }
    16651670    }
    16661671   
    … …  
    16791684    if (doc)
    16801685        return doc->axObjectCache();
    1681     return 0;
     1686    return nullptr;
    16821687}
    16831688   
    … …  
    20182023    bool isIgnored = accessibilityIsIgnored();
    20192024    if (lastKnownIsIgnoredValue() != isIgnored) {
    2020         axObjectCache()->childrenChanged(parentObject());
     2025        if (AXObjectCache* cache = axObjectCache())
     2026            cache->childrenChanged(parentObject());
    20212027        setLastKnownIsIgnoredValue(isIgnored);
    20222028    }
    … …  
    21032109bool AccessibilityObject::accessibilityIsIgnored() const
    21042110{
    2105     AXComputedObjectAttributeCache* attributeCache = axObjectCache()->computedObjectAttributeCache();
     2111    AXComputedObjectAttributeCache* attributeCache = nullptr;
     2112    if (AXObjectCache* cache = axObjectCache())
     2113        attributeCache = cache->computedObjectAttributeCache();
     2114   
    21062115    if (attributeCache) {
    21072116        AccessibilityObjectInclusion ignored = attributeCache->getIgnored(axObjectID());

  • trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp

    r163440 r163586  
    477477AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
    478478{
     479    AXObjectCache* cache = axObjectCache();
     480    if (!cache)
     481        return nullptr;
     482   
    479483    // WebArea's parent should be the scroll view containing it.
    480484    if (isWebArea())
    481         return axObjectCache()->get(&m_renderer->view().frameView());
    482 
    483     return axObjectCache()->get(renderParentObject());
     485        return cache->get(&m_renderer->view().frameView());
     486
     487    return cache->get(renderParentObject());
    484488}
    485489   
    … …  
    499503    }
    500504   
     505    AXObjectCache* cache = axObjectCache();
     506    if (!cache)
     507        return nullptr;
     508   
    501509    RenderObject* parentObj = renderParentObject();
    502510    if (parentObj)
    503         return axObjectCache()->getOrCreate(parentObj);
     511        return cache->getOrCreate(parentObj);
    504512   
    505513    // WebArea's parent should be the scroll view containing it.
    506514    if (isWebArea())
    507         return axObjectCache()->getOrCreate(&m_renderer->view().frameView());
     515        return cache->getOrCreate(&m_renderer->view().frameView());
    508516   
    509517    return 0;
    … …  
    563571   
    564572    AXObjectCache* cache = axObjectCache();
     573    if (!cache)
     574        return nullptr;
     575   
    565576    RenderObject* currRenderer;
    566577   
    … …  
    15881599    elementsFromAttribute(elements, aria_controlsAttr);
    15891600   
     1601    AXObjectCache* cache = axObjectCache();
     1602    if (!cache)
     1603        return false;
     1604   
    15901605    for (const auto& element : elements) {
    1591         AccessibilityObject* tabPanel = axObjectCache()->getOrCreate(element);
     1606        AccessibilityObject* tabPanel = cache->getOrCreate(element);
    15921607
    15931608        // A tab item should only control tab panels.
    … …  
    17321747        return 0;
    17331748   
    1734     return axObjectCache()->getOrCreate(imageElement);
     1749    if (AXObjectCache* cache = axObjectCache())
     1750        return cache->getOrCreate(imageElement);
     1751   
     1752    return nullptr;
    17351753}
    17361754   
    … …  
    19031921        return false;
    19041922
    1905     const AccessibilityObject* axObjectForNode = axObjectCache()->getOrCreate(const_cast<Node*>(node));
    1906     if (!axObjectForNode)
    1907         return false;
    1908 
    1909     return axObjectForNode->isTextControl();
     1923    if (AXObjectCache* cache = axObjectCache()) {
     1924        if (AccessibilityObject* axObjectForNode = cache->getOrCreate(const_cast<Node*>(node)))
     1925            return axObjectForNode->isTextControl();
     1926    }
     1927
     1928    return false;
    19101929}
    19111930
    … …  
    22772296        return 0;
    22782297   
    2279     AccessibilityObject* obj = axObjectCache()->getOrCreate(target);
    2280     if (obj && obj->isAccessibilityRenderObject())
    2281     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
    2282         return obj;
     2298    if (AXObjectCache* cache = axObjectCache()) {
     2299        AccessibilityObject* obj = cache->getOrCreate(target);
     2300        if (obj && obj->isAccessibilityRenderObject())
     2301            // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
     2302            return obj;
     2303    }
     2304   
    22832305    return 0;
    22842306}
    … …  
    23102332   
    23112333    // Post that the row count changed.
     2334    AXObjectCache* cache = axObjectCache();
     2335    if (!cache)
     2336        return;
     2337   
    23122338    if (containerParent)
    2313         axObjectCache()->postNotification(containerParent, document(), AXObjectCache::AXRowCountChanged);
     2339        cache->postNotification(containerParent, document(), AXObjectCache::AXRowCountChanged);
    23142340
    23152341    // Post that the specific row either collapsed or expanded.
    23162342    if (roleValue() == RowRole || roleValue() == TreeItemRole)
    2317         axObjectCache()->postNotification(this, document(), isExpanded() ? AXObjectCache::AXRowExpanded : AXObjectCache::AXRowCollapsed);
     2343        cache->postNotification(this, document(), isExpanded() ? AXObjectCache::AXRowExpanded : AXObjectCache::AXRowCollapsed);
    23182344}
    23192345
    … …  
    23892415    // Find the object going up the parent chain that is used in accessibility to monitor certain notifications.
    23902416    for (RenderObject* renderer = m_renderer; renderer && renderer->node(); renderer = renderer->parent()) {
    2391         if (renderObjectIsObservable(renderer))
    2392             return axObjectCache()->getOrCreate(renderer);
     2417        if (renderObjectIsObservable(renderer)) {
     2418            if (AXObjectCache* cache = axObjectCache())
     2419                return cache->getOrCreate(renderer);
     2420        }
    23932421    }
    23942422   
    … …  
    27152743    // then notify the AT of changes.
    27162744    AXObjectCache* cache = axObjectCache();
     2745    if (!cache)
     2746        return;
     2747   
    27172748    for (RenderObject* renderParent = m_renderer; renderParent; renderParent = renderParent->parent()) {
    27182749        AccessibilityObject* parent = cache->get(renderParent);

  • trunk/Source/WebCore/accessibility/AccessibilityScrollView.cpp

    r160778 r163586  
    150150        return 0;
    151151   
    152     AccessibilityScrollbar* scrollBarObject = toAccessibilityScrollbar(axObjectCache()->getOrCreate(scrollbar));
     152    AXObjectCache* cache = axObjectCache();
     153    if (!cache)
     154        return nullptr;
     155
     156    AccessibilityScrollbar* scrollBarObject = toAccessibilityScrollbar(cache->getOrCreate(scrollbar));
    153157    scrollBarObject->setParent(this);
    154158    m_children.append(scrollBarObject);
    … …  
    193197        return 0;
    194198
    195     return axObjectCache()->getOrCreate(doc);
     199    if (AXObjectCache* cache = axObjectCache())
     200        return cache->getOrCreate(doc);
     201   
     202    return nullptr;
    196203}
    197204
    … …  
    230237    if (!m_scrollView || !m_scrollView->isFrameView())
    231238        return 0;
    232    
     239
     240    AXObjectCache* cache = axObjectCache();
     241    if (!cache)
     242        return nullptr;
     243
    233244    HTMLFrameOwnerElement* owner = toFrameView(m_scrollView)->frame().ownerElement();
    234245    if (owner && owner->renderer())
    235         return axObjectCache()->getOrCreate(owner);
     246        return cache->getOrCreate(owner);
    236247
    237248    return 0;
    … …  
    243254        return 0;
    244255   
     256    AXObjectCache* cache = axObjectCache();
     257    if (!cache)
     258        return nullptr;
     259
    245260    HTMLFrameOwnerElement* owner = toFrameView(m_scrollView)->frame().ownerElement();
    246261    if (owner && owner->renderer())
    247         return axObjectCache()->get(owner);
     262        return cache->get(owner);
    248263   
    249264    return 0;
Note: See TracChangeset for help on using the changeset viewer.