Changeset 202647 in webkit


Ignore:
Timestamp:
Jun 29, 2016 2:23:29 PM (8 years ago)
Author:
n_wang@apple.com
Message:

AX: Crash in WebCore::Document::focusNavigationStartingNode(WebCore::FocusDirection) const + 128
​https://bugs.webkit.org/show_bug.cgi?id=159240

Reviewed by Ryosuke Niwa.

Source/WebCore:

This crash is caused by passing an empty node to ElementTraversal::previous(Node&). When the
focusNavigationStartingNode has been removed and it has no next sibling, we should fallback
to itself for calculating the next focused element.

Test: fast/events/remove-focus-navigation-starting-point-crash.html

  • dom/Document.cpp:

(WebCore::Document::focusNavigationStartingNode):

LayoutTests:

  • fast/events/remove-focus-navigation-starting-point-crash-expected.txt: Added.
  • fast/events/remove-focus-navigation-starting-point-crash.html: Added.
  • platform/ios-simulator/TestExpectations:
Location:
trunk
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r202646 r202647  
     12016-06-29  Nan Wang  <n_wang@apple.com>
     2
     3        AX: Crash in WebCore::Document::focusNavigationStartingNode(WebCore::FocusDirection) const + 128
     4        https://bugs.webkit.org/show_bug.cgi?id=159240
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        * fast/events/remove-focus-navigation-starting-point-crash-expected.txt: Added.
     9        * fast/events/remove-focus-navigation-starting-point-crash.html: Added.
     10        * platform/ios-simulator/TestExpectations:
     11
    1122016-06-29  Ryan Haddad  <ryanhaddad@apple.com>
    213

  • trunk/LayoutTests/platform/ios-simulator/TestExpectations

    r202625 r202647  
    276276fast/shadow-dom/negative-tabindex-on-shadow-host.html [ Failure ]
    277277webkit.org/b/116046 fast/events/sequential-focus-navigation-starting-point.html [ Skip ]
     278webkit.org/b/159240 fast/events/remove-focus-navigation-starting-point-crash.html [ Skip ]
    278279
    279280webkit.org/b/150225 fast/custom-elements [ Pass ]

  • trunk/Source/WebCore/ChangeLog

    r202645 r202647  
     12016-06-29  Nan Wang  <n_wang@apple.com>
     2
     3        AX: Crash in WebCore::Document::focusNavigationStartingNode(WebCore::FocusDirection) const + 128
     4        https://bugs.webkit.org/show_bug.cgi?id=159240
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        This crash is caused by passing an empty node to ElementTraversal::previous(Node&). When the
     9        focusNavigationStartingNode has been removed and it has no next sibling, we should fallback
     10        to itself for calculating the next focused element.
     11
     12        Test: fast/events/remove-focus-navigation-starting-point-crash.html
     13
     14        * dom/Document.cpp:
     15        (WebCore::Document::focusNavigationStartingNode):
     16
    1172016-06-29  Ryan Haddad  <ryanhaddad@apple.com>
    218

  • trunk/Source/WebCore/dom/Document.cpp

    r202578 r202647  
    39413941    if (m_focusNavigationStartingNodeIsRemoved) {
    39423942        Node* nextNode = NodeTraversal::next(*node);
     3943        if (!nextNode)
     3944            nextNode = node;
    39433945        if (direction == FocusDirectionForward)
    39443946            return ElementTraversal::previous(*nextNode);
Note: See TracChangeset for help on using the changeset viewer.