Changeset 258609 in webkit

Timestamp:

Mar 17, 2020 4:02:36 PM (4 years ago)

Author:

Chris Fleizach

Message:

AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.
​https://bugs.webkit.org/show_bug.cgi?id=208844
<rdar://problem/60252659>

Reviewed by Darin Adler.

Source/WebCore:

Test: accessibility/mac/crash-bounds-for-range.html

Don't access renderer if nil in getInlineBoxAndOffset.

• dom/Position.cpp:

(WebCore::Position::getInlineBoxAndOffset const):

LayoutTests:

• accessibility/mac/crash-bounds-for-range-expected.txt: Added.
• accessibility/mac/crash-bounds-for-range.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/accessibility/mac/crash-bounds-for-range-expected.txt (added)
• LayoutTests/accessibility/mac/crash-bounds-for-range.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Position.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-03-17  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.
+        https://bugs.webkit.org/show_bug.cgi?id=208844
+        <rdar://problem/60252659>
+
+        Reviewed by Darin Adler.
+
+        * accessibility/mac/crash-bounds-for-range-expected.txt: Added.
+        * accessibility/mac/crash-bounds-for-range.html: Added.
+
 2020-03-17  Jacob Uphoff  <jacob_uphoff@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-03-17  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.
+        https://bugs.webkit.org/show_bug.cgi?id=208844
+        <rdar://problem/60252659>
+
+        Reviewed by Darin Adler.
+
+        Test: accessibility/mac/crash-bounds-for-range.html
+
+        Don't access renderer if nil in getInlineBoxAndOffset.
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset const):
+
 2020-03-17  Eric Carlson  <eric.carlson@apple.com>
 

trunk/Source/WebCore/dom/Position.cpp

@@ -1207 +1207 @@
     caretOffset = deprecatedEditingOffset();
     RenderObject* renderer = deprecatedNode()->renderer();
-
+    if (!renderer)
+        return;
+    
     if (renderer->isBR()) {
         auto& lineBreakRenderer = downcast<RenderLineBreak>(*renderer);