Changeset 170704 in webkit

Timestamp:

Jul 2, 2014 2:52:38 AM (10 years ago)

Author:

mario.prada@samsung.com

Message:

REGRESSION(r170008): [GTK] Layout Tests fast/forms/option-constructor-selected.html and fast/forms/select-live-pseudo-selectors.html crash.
​https://bugs.webkit.org/show_bug.cgi?id=134399

Reviewed by Chris Fleizach.

Source/WebCore:
Check that the value of optionIndex passed as a parameter is valid
before calling didUpdateActiveOption() over the item of the menu
list, to prevent crashes in platforms where renderers (and therefore
accessibility objects) might not be created for items at the time
of calling AccessibilityMenuList::didUpdateActiveOption().

• accessibility/AccessibilityMenuList.cpp:

(WebCore::AccessibilityMenuList::didUpdateActiveOption): Added check.

LayoutTests:
Removing Crash expectations for two layout tests.

• platform/gtk/TestExpectations: Updated.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/gtk/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/accessibility/AccessibilityMenuList.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-07-02  Mario Sanchez Prada  <mario.prada@samsung.com>
+
+        REGRESSION(r170008): [GTK] Layout Tests fast/forms/option-constructor-selected.html and fast/forms/select-live-pseudo-selectors.html crash.
+        https://bugs.webkit.org/show_bug.cgi?id=134399
+
+        Reviewed by Chris Fleizach.
+
+        Removing Crash expectations for two layout tests.
+
+        * platform/gtk/TestExpectations: Updated.
+
 2014-07-01  Frédéric Wang  <fred.wang@free.fr>
 

trunk/LayoutTests/platform/gtk/TestExpectations

@@ -515 +515 @@
 
 webkit.org/b/133797 fast/dom/NavigatorContentUtils/register-protocol-handler.html [ Crash ]
-
-webkit.org/b/134399 fast/forms/option-constructor-selected.html [ Crash ]
-webkit.org/b/134399 fast/forms/select-live-pseudo-selectors.html [ Crash ]
 
 #////////////////////////////////////////////////////////////////////////////////////////

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-07-02  Mario Sanchez Prada  <mario.prada@samsung.com>
+
+        REGRESSION(r170008): [GTK] Layout Tests fast/forms/option-constructor-selected.html and fast/forms/select-live-pseudo-selectors.html crash.
+        https://bugs.webkit.org/show_bug.cgi?id=134399
+
+        Reviewed by Chris Fleizach.
+
+        Check that the value of optionIndex passed as a parameter is valid
+        before calling didUpdateActiveOption() over the item of the menu
+        list, to prevent crashes in platforms where renderers (and therefore
+        accessibility objects) might not be created for items at the time
+        of calling AccessibilityMenuList::didUpdateActiveOption().
+
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::didUpdateActiveOption): Added check.
+
 2014-07-02  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp

@@ -121 +121 @@
         // You can reproduce the issue in the GTK+ port by removing this check and running
         // accessibility/insert-selected-option-into-select-causes-crash.html (will crash).
-        if (childObjects[0]->isMenuListPopup() && childObjects[0]->children().size()) {
+        int popupChildrenSize = static_cast<int>(childObjects[0]->children().size());
+        if (childObjects[0]->isMenuListPopup() && optionIndex >= 0 && optionIndex < popupChildrenSize) {
             if (AccessibilityMenuListPopup* popup = toAccessibilityMenuListPopup(childObjects[0].get()))
                 popup->didUpdateActiveOption(optionIndex);