Changeset 255095 in webkit

Timestamp:

Jan 24, 2020 2:52:07 PM (4 years ago)

Author:

Andres Gonzalez

Message:

Crash in AXIsolatedObject::tagName.
​https://bugs.webkit.org/show_bug.cgi?id=206765

Reviewed by Chris Fleizach.

Fixes crash in AXIsolatedObject::tagName.

• accessibility/isolatedtree/AXIsolatedObject.cpp:

(WebCore::AXIsolatedObject::initializeAttributeData): Was missing the isolatedCopy when caching the tagName.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• accessibility/isolatedtree/AXIsolatedObject.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-01-24  Andres Gonzalez  <andresg_22@apple.com>
+
+        Crash in AXIsolatedObject::tagName.
+        https://bugs.webkit.org/show_bug.cgi?id=206765
+
+        Reviewed by Chris Fleizach.
+
+        Fixes crash in AXIsolatedObject::tagName.
+
+        * accessibility/isolatedtree/AXIsolatedObject.cpp:
+        (WebCore::AXIsolatedObject::initializeAttributeData): Was missing the isolatedCopy when caching the tagName.
+
 2020-01-24  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp

@@ -205 +205 @@
     setProperty(AXPropertyName::CanHaveSelectedChildren, object.canHaveSelectedChildren());
     setProperty(AXPropertyName::HasARIAValueNow, object.hasARIAValueNow());
-    setProperty(AXPropertyName::TagName, object.tagName());
+    setProperty(AXPropertyName::TagName, object.tagName().isolatedCopy());
     setProperty(AXPropertyName::SupportsLiveRegion, object.supportsLiveRegion());
     setProperty(AXPropertyName::IsInsideLiveRegion, object.isInsideLiveRegion());