Changeset 220463 in webkit

Timestamp:

Aug 9, 2017 10:52:36 AM (7 years ago)

Author:

n_wang@apple.com

Message:

AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24
​https://bugs.webkit.org/show_bug.cgi?id=175340
<rdar://problem/33782159>

Reviewed by Chris Fleizach.

Source/WebCore:

When adding a psuedo element child to a RenderBlockFlow element, there might be a chance where
the element has already been layed out but we are still holding onto its stale children. Fixed it
by notifying AX correctly when inserting/removing children during layout.

Test: accessibility/add-children-pseudo-element.html

• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::insertFloatingObject):
(WebCore::RenderBlockFlow::removeFloatingObject):

LayoutTests:

• accessibility/add-children-pseudo-element-expected.txt: Added.
• accessibility/add-children-pseudo-element.html: Added.
• accessibility/resources/svg-circle.svg: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/accessibility/add-children-pseudo-element-expected.txt (added)
• LayoutTests/accessibility/add-children-pseudo-element.html (added)
• LayoutTests/accessibility/resources/svg-circle.svg (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockFlow.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-08-09  Nan Wang  <n_wang@apple.com>
+
+        AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24
+        https://bugs.webkit.org/show_bug.cgi?id=175340
+        <rdar://problem/33782159>
+
+        Reviewed by Chris Fleizach.
+
+        * accessibility/add-children-pseudo-element-expected.txt: Added.
+        * accessibility/add-children-pseudo-element.html: Added.
+        * accessibility/resources/svg-circle.svg: Added.
+
 2017-08-09  Ms2ger  <Ms2ger@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-08-09  Nan Wang  <n_wang@apple.com>
+
+        AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24
+        https://bugs.webkit.org/show_bug.cgi?id=175340
+        <rdar://problem/33782159>
+
+        Reviewed by Chris Fleizach.
+
+        When adding a psuedo element child to a RenderBlockFlow element, there might be a chance where
+        the element has already been layed out but we are still holding onto its stale children. Fixed it
+        by notifying AX correctly when inserting/removing children during layout.
+
+        Test: accessibility/add-children-pseudo-element.html
+
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::insertFloatingObject):
+        (WebCore::RenderBlockFlow::removeFloatingObject):
+
 2017-08-09  Charlie Turner  <cturner@igalia.com>
 

trunk/Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -25 +25 @@
 #include "RenderBlockFlow.h"
 
+#include "AXObjectCache.h"
 #include "Editor.h"
 #include "FloatingObjects.h"
@@ -2353 +2354 @@
 
     setLogicalWidthForFloat(*floatingObject, logicalWidthForChild(floatBox) + marginStartForChild(floatBox) + marginEndForChild(floatBox));
+    
+    if (AXObjectCache* cache = document().existingAXObjectCache())
+        cache->childrenChanged(this);
 
     return m_floatingObjects->add(WTFMove(floatingObject));
@@ -2390 +2394 @@
             }
             m_floatingObjects->remove(&floatingObject);
+            
+            if (AXObjectCache* cache = document().existingAXObjectCache())
+                cache->childrenChanged(this);
         }
     }