AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] …

…+ 24 https://bugs.webkit.org/show_bug.cgi?id=178697 Reviewed by Chris Fleizach. Source/WebCore: When we are calling _accessibilityMinValue and _accessibilityMaxValue on iOS, it might cause crash if the AX object has already been detached. Fixed this by adding the necessary checks. Test: accessibility/ios-simulator/slider-min-value-crash.html * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm: (-[WebAccessibilityObjectWrapper _accessibilityMinValue]): (-[WebAccessibilityObjectWrapper _accessibilityMaxValue]): LayoutTests: * accessibility/ios-simulator/slider-min-value-crash-expected.txt: Added. * accessibility/ios-simulator/slider-min-value-crash.html: Added. Canonical link: https://commits.webkit.org/194877@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@223881 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Oct 24, 2017 · c6fa2aeb6744b89f34d2d95767a2dd19cafd3a87 · c6fa2ae
1 parent 092026a
commit c6fa2aeb6744b89f34d2d95767a2dd19cafd3a87
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2017-10-24  Nan Wang  <n_wang@apple.com>
+
+        AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] + 24
+        https://bugs.webkit.org/show_bug.cgi?id=178697
+
+        Reviewed by Chris Fleizach.
+
+        * accessibility/ios-simulator/slider-min-value-crash-expected.txt: Added.
+        * accessibility/ios-simulator/slider-min-value-crash.html: Added.
+
 2017-10-23  Michael Catanzaro  <mcatanzaro@igalia.com>
 
         Unreviewed WPE test gardening

diff --git a/LayoutTests/accessibility/ios-simulator/slider-min-value-crash-expected.txt b/LayoutTests/accessibility/ios-simulator/slider-min-value-crash-expected.txt
@@ -0,0 +1,11 @@
+This tests that accessing the min/max value of a detached ax object won't cause crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sliderObj.minValue is 25
+PASS sliderObj.minValue is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/ios-simulator/slider-min-value-crash.html b/LayoutTests/accessibility/ios-simulator/slider-min-value-crash.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<input type="range" id="slider" value="50" min="25" max="75">
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests that accessing the min/max value of a detached ax object won't cause crash.");
+
+    if (window.accessibilityController) {
+
+        var sliderObj = accessibilityController.accessibleElementById("slider");
+        shouldBe("sliderObj.minValue", "25");
+
+        // Remove the element
+        var slider = document.getElementById("slider");
+        slider.parentNode.removeChild(slider);
+
+        // Make sure it won't crash
+        shouldBe("sliderObj.minValue", "0");
+    }
+
+</script>
+
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2017-10-24  Nan Wang  <n_wang@apple.com>
+
+        AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] + 24
+        https://bugs.webkit.org/show_bug.cgi?id=178697
+
+        Reviewed by Chris Fleizach.
+
+        When we are calling _accessibilityMinValue and _accessibilityMaxValue on iOS, 
+        it might cause crash if the AX object has already been detached. Fixed this 
+        by adding the necessary checks.
+
+        Test: accessibility/ios-simulator/slider-min-value-crash.html
+
+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+        (-[WebAccessibilityObjectWrapper _accessibilityMinValue]):
+        (-[WebAccessibilityObjectWrapper _accessibilityMaxValue]):
+
 2017-10-23  Keith Miller  <keith_miller@apple.com>
 
         Unreviewed, restore unneeded all in ones.

diff --git a/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm b/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm
@@ -1085,11 +1085,17 @@ - (BOOL)_accessibilityValueIsAutofilled
 
 - (CGFloat)_accessibilityMinValue
 {
+    if (![self _prepareAccessibilityCall])
+        return 0;
+
     return m_object->minValueForRange();
 }
 
 - (CGFloat)_accessibilityMaxValue
 {
+    if (![self _prepareAccessibilityCall])
+        return 0;
+
     return m_object->maxValueForRange();
 }