Skip to content
Permalink
Browse files
AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] …
…+ 24

https://bugs.webkit.org/show_bug.cgi?id=178697

Reviewed by Chris Fleizach.

Source/WebCore:

When we are calling _accessibilityMinValue and _accessibilityMaxValue on iOS,
it might cause crash if the AX object has already been detached. Fixed this
by adding the necessary checks.

Test: accessibility/ios-simulator/slider-min-value-crash.html

* accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper _accessibilityMinValue]):
(-[WebAccessibilityObjectWrapper _accessibilityMaxValue]):

LayoutTests:

* accessibility/ios-simulator/slider-min-value-crash-expected.txt: Added.
* accessibility/ios-simulator/slider-min-value-crash.html: Added.


Canonical link: https://commits.webkit.org/194877@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@223881 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
Nan Wang committed Oct 24, 2017
1 parent 092026a commit c6fa2aeb6744b89f34d2d95767a2dd19cafd3a87
@@ -1,3 +1,13 @@
2017-10-24 Nan Wang <n_wang@apple.com>

AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] + 24
https://bugs.webkit.org/show_bug.cgi?id=178697

Reviewed by Chris Fleizach.

* accessibility/ios-simulator/slider-min-value-crash-expected.txt: Added.
* accessibility/ios-simulator/slider-min-value-crash.html: Added.

2017-10-23 Michael Catanzaro <mcatanzaro@igalia.com>

Unreviewed WPE test gardening
@@ -0,0 +1,11 @@
This tests that accessing the min/max value of a detached ax object won't cause crash.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS sliderObj.minValue is 25
PASS sliderObj.minValue is 0
PASS successfullyParsed is true

TEST COMPLETE

@@ -0,0 +1,34 @@
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body id="body">

<input type="range" id="slider" value="50" min="25" max="75">

<p id="description"></p>
<div id="console"></div>

<script>

description("This tests that accessing the min/max value of a detached ax object won't cause crash.");

if (window.accessibilityController) {

var sliderObj = accessibilityController.accessibleElementById("slider");
shouldBe("sliderObj.minValue", "25");

// Remove the element
var slider = document.getElementById("slider");
slider.parentNode.removeChild(slider);

// Make sure it won't crash
shouldBe("sliderObj.minValue", "0");
}

</script>

<script src="../../resources/js-test-post.js"></script>
</body>
</html>
@@ -1,3 +1,20 @@
2017-10-24 Nan Wang <n_wang@apple.com>

AX: Crash at -[WebAccessibilityObjectWrapper _accessibilityMinValue] + 24
https://bugs.webkit.org/show_bug.cgi?id=178697

Reviewed by Chris Fleizach.

When we are calling _accessibilityMinValue and _accessibilityMaxValue on iOS,
it might cause crash if the AX object has already been detached. Fixed this
by adding the necessary checks.

Test: accessibility/ios-simulator/slider-min-value-crash.html

* accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper _accessibilityMinValue]):
(-[WebAccessibilityObjectWrapper _accessibilityMaxValue]):

2017-10-23 Keith Miller <keith_miller@apple.com>

Unreviewed, restore unneeded all in ones.
@@ -1085,11 +1085,17 @@ - (BOOL)_accessibilityValueIsAutofilled

- (CGFloat)_accessibilityMinValue
{
if (![self _prepareAccessibilityCall])
return 0;

return m_object->minValueForRange();
}

- (CGFloat)_accessibilityMaxValue
{
if (![self _prepareAccessibilityCall])
return 0;

return m_object->maxValueForRange();
}

0 comments on commit c6fa2ae

Please sign in to comment.