Merge r176254 - AX: [ATK] Crash getting the orientation of a MenuList…

…Option after the MenuList was removed from the document https://bugs.webkit.org/show_bug.cgi?id=138727 Reviewed by Chris Fleizach. Source/WebCore: AccessibilityMenuListOption::elementRect() returns the value of the grandparent MenuList, asserting that the grandparent exists with that role. But it is possible to have an existing MenuListOption and remove the element which had been backing that MenuList from the document. Adding null checks prior to the assertions prevents our crashing if the parent or grandparent was removed. Test: platform/gtk/accessibility/combobox-descendants-orientation-crash.html * accessibility/AccessibilityMenuListOption.cpp: (WebCore::AccessibilityMenuListOption::elementRect): LayoutTests: * platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt: Added. * platform/gtk/accessibility/combobox-descendants-orientation-crash.html: Added. Canonical link: https://commits.webkit.org/154760.218@webkitgtk/2.6 git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@176389 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Nov 20, 2014 · b563974 · b563974
1 parent 7e395f0
commit b563974
Show file tree

Hide file tree

Showing 5 changed files with 89 additions and 0 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2014-11-18  Joanmarie Diggs  <jdiggs@igalia.com>
+
+        AX: [ATK] Crash getting the orientation of a MenuListOption after the MenuList was removed from the document
+        https://bugs.webkit.org/show_bug.cgi?id=138727
+
+        Reviewed by Chris Fleizach.
+
+        * platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt: Added.
+        * platform/gtk/accessibility/combobox-descendants-orientation-crash.html: Added.
+
 2014-11-16  Chris Dumez  <cdumez@apple.com>
 
         Assertion hit when setting a very large value to 'border-width' / 'font-size' CSS properties

diff --git a/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt b/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash-expected.txt
@@ -0,0 +1,18 @@
+This verifies that getting the orientation of combobox descendants won't crash if the combobox is removed from the document.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+AXRole: AXComboBox has orientation: AXOrientation: AXHorizontalOrientation
+
+Before combobox removal
+AXRole: AXMenu has orientation: AXOrientation: AXHorizontalOrientation
+AXRole: AXMenuItem has orientation: AXOrientation: AXHorizontalOrientation
+
+After combobox removal
+AXRole: AXInvalid has orientation: AXOrientation: AXHorizontalOrientation
+AXRole: AXInvalid has orientation: AXOrientation: AXHorizontalOrientation
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash.html b/LayoutTests/platform/gtk/accessibility/combobox-descendants-orientation-crash.html
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<select id="combobox">
+<option value="foo">foo</option>
+<option value="bar">bar</option>
+</select>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This verifies that getting the orientation of combobox descendants won't crash if the combobox is removed from the document.");
+
+if (window.testRunner && window.accessibilityController) {
+    var combobox = document.getElementById("combobox");
+    combobox.focus();
+
+    var axCombobox = accessibilityController.focusedElement;
+    var axMenu = axCombobox.childAtIndex(0);
+    var axMenuItem = axMenu.childAtIndex(0);
+
+    debug(axCombobox.role + " has orientation: " + axCombobox.orientation);
+
+    debug("\nBefore combobox removal");
+    debug(axMenu.role + " has orientation: " + axMenu.orientation);
+    debug(axMenuItem.role + " has orientation: " + axMenuItem.orientation);
+
+    document.body.removeChild(combobox);
+    debug("\nAfter combobox removal");
+    debug(axMenu.role + " has orientation: " + axMenu.orientation);
+    debug(axMenuItem.role + " has orientation: " + axMenuItem.orientation);
+}
+</script>
+<script src="../../../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2014-11-18  Joanmarie Diggs  <jdiggs@igalia.com>
+
+        AX: [ATK] Crash getting the orientation of a MenuListOption after the MenuList was removed from the document
+        https://bugs.webkit.org/show_bug.cgi?id=138727
+
+        Reviewed by Chris Fleizach.
+
+        AccessibilityMenuListOption::elementRect() returns the value of the
+        grandparent MenuList, asserting that the grandparent exists with that
+        role. But it is possible to have an existing MenuListOption and remove
+        the element which had been backing that MenuList from the document.
+        Adding null checks prior to the assertions prevents our crashing if the
+        parent or grandparent was removed.
+
+        Test: platform/gtk/accessibility/combobox-descendants-orientation-crash.html
+
+        * accessibility/AccessibilityMenuListOption.cpp:
+        (WebCore::AccessibilityMenuListOption::elementRect):
+
 2014-11-16  Chris Dumez  <cdumez@apple.com>
 
         Assertion hit when setting a very large value to 'border-width' / 'font-size' CSS properties

diff --git a/Source/WebCore/accessibility/AccessibilityMenuListOption.cpp b/Source/WebCore/accessibility/AccessibilityMenuListOption.cpp
@@ -104,9 +104,13 @@ bool AccessibilityMenuListOption::computeAccessibilityIsIgnored() const
 LayoutRect AccessibilityMenuListOption::elementRect() const
 {
     AccessibilityObject* parent = parentObject();
+    if (!parent)
+        return boundingBoxRect();
     ASSERT(parent->isMenuListPopup());
 
     AccessibilityObject* grandparent = parent->parentObject();
+    if (!grandparent)
+        return boundingBoxRect();
     ASSERT(grandparent->isMenuList());
 
     return grandparent->elementRect();