Changeset 200318 in webkit

Timestamp:

May 1, 2016 11:14:36 PM (8 years ago)

Author:

n_wang@apple.com

Message:

AX: Crash at WebCore::AccessibilityObject::getAttribute const + 9
​https://bugs.webkit.org/show_bug.cgi?id=157256

Reviewed by Chris Fleizach.

Source/WebCore:

When the <label> for the input element has no renderer, it will cause
crash when we ask for the title element text. Fixed it by getting the
aria-label attribute directly from the <label> element instead of its
accessibility object.

Test case covered in accessibility/mac/aria-label-on-label-element.html.

• accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::titleElementText):

LayoutTests:

• accessibility/mac/aria-label-on-label-element-expected.txt:
• accessibility/mac/aria-label-on-label-element.html:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/accessibility/mac/aria-label-on-label-element-expected.txt (modified) (2 diffs)
• LayoutTests/accessibility/mac/aria-label-on-label-element.html (modified) (2 diffs)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/accessibility/AccessibilityNodeObject.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-05-01  Nan Wang  <n_wang@apple.com>
+
+        AX: Crash at  WebCore::AccessibilityObject::getAttribute const + 9
+        https://bugs.webkit.org/show_bug.cgi?id=157256
+
+        Reviewed by Chris Fleizach.
+
+        * accessibility/mac/aria-label-on-label-element-expected.txt:
+        * accessibility/mac/aria-label-on-label-element.html:
+
 2016-05-01  Commit Queue  <commit-queue@webkit.org>
 

trunk/LayoutTests/accessibility/mac/aria-label-on-label-element-expected.txt

@@ -1 @@
-Some text  Some other text 
+Some text  Some other text   
 This tests that the aria-label attribute works on element.
 
@@ -8 +8 @@
 PASS input1.title is 'AXTitle: aria label'
 PASS titleUIElement2.isEqual(accessibilityController.accessibleElementById('label2')) is true
+PASS input3.title is 'AXTitle: hidden aria label'
 PASS successfullyParsed is true
 

trunk/LayoutTests/accessibility/mac/aria-label-on-label-element.html

@@ -11 +11 @@
 <label id="label2" for="input2">Some other text</label>
 <input id="input2" type="text" size=20>
+
+<label id="label3" for="input3" hidden aria-label="hidden aria label">hidden text</label>
+<input id="input3" type="text">
 
 <p id="description"></p>
@@ -31 +34 @@
         var titleUIElement2 = input2.titleUIElement();
         shouldBeTrue("titleUIElement2.isEqual(accessibilityController.accessibleElementById('label2'))");
+        
+        // Make sure when the input element has no rendered label, it won't cause crash.
+        var input3 = accessibilityController.accessibleElementById("input3");
+        shouldBe("input3.title", "'AXTitle: hidden aria label'");
     }
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-05-01  Nan Wang  <n_wang@apple.com>
+
+        AX: Crash at  WebCore::AccessibilityObject::getAttribute const + 9
+        https://bugs.webkit.org/show_bug.cgi?id=157256
+
+        Reviewed by Chris Fleizach.
+
+        When the <label> for the input element has no renderer, it will cause
+        crash when we ask for the title element text. Fixed it by getting the 
+        aria-label attribute directly from the <label> element instead of its 
+        accessibility object. 
+
+        Test case covered in accessibility/mac/aria-label-on-label-element.html.
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::titleElementText):
+
 2016-05-01  Darin Adler  <darin@apple.com>
 

trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp

@@ -1267 +1267 @@
             String innerText = label->innerText();
             
-            const AtomicString& ariaLabel = labelObject->getAttribute(aria_labelAttr);
+            const AtomicString& ariaLabel = label->fastGetAttribute(aria_labelAttr);
             if (!ariaLabel.isEmpty())
                 innerText = ariaLabel;