Skip to content
Permalink
Browse files
AX: Crash at -[WebAccessibilityObjectWrapper accessibilityAttributeVa…
…lue:] + 4391

https://bugs.webkit.org/show_bug.cgi?id=156987

Reviewed by Chris Fleizach.

Source/WebCore:

When we hit test on a slider indicator asking for the value when the parent slider's
accessibility object is not created or the parent slider has been removed, it will cause
crash. Fixed it by adding a check to see if the object is detached from the parent.

Test: accessibility/mac/slider-thumb-value-crash.html

* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

LayoutTests:

* accessibility/mac/slider-thumb-value-crash-expected.txt: Added.
* accessibility/mac/slider-thumb-value-crash.html: Added.


Canonical link: https://commits.webkit.org/175110@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200054 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
Nan Wang committed Apr 25, 2016
1 parent 72aca28 commit ffdd4e28536b70c03e7ae0da4095a1c0e8d25b20
@@ -1,3 +1,13 @@
2016-04-25 Nan Wang <n_wang@apple.com>

AX: Crash at -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 4391
https://bugs.webkit.org/show_bug.cgi?id=156987

Reviewed by Chris Fleizach.

* accessibility/mac/slider-thumb-value-crash-expected.txt: Added.
* accessibility/mac/slider-thumb-value-crash.html: Added.

2016-04-25 Brady Eidson <beidson@apple.com>

Attempt to fix a flaky test after r200032
@@ -0,0 +1,10 @@
This tests that getting the indicator's value from a removed slider won't cause crash.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS indicator.intValue is 0
PASS successfullyParsed is true

TEST COMPLETE

@@ -0,0 +1,32 @@
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body id="body">

<input id="range1" type="range">

<p id="description"></p>
<div id="console"></div>
<div id="notifications"></div>

<script>

description("This tests that getting the indicator's value from a removed slider won't cause crash.");

if (window.accessibilityController) {

var range = accessibilityController.accessibleElementById("range1");
var indicator = range.childAtIndex(0);

// Remove the slider, make sure we getting value from the indicator won't cause crash.
var rangeElement = document.getElementById("range1");
document.body.removeChild(rangeElement);
shouldBe("indicator.intValue", "0");
}

</script>

<script src="../../resources/js-test-post.js"></script>
</body>
</html>
@@ -1,3 +1,19 @@
2016-04-25 Nan Wang <n_wang@apple.com>

AX: Crash at -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 4391
https://bugs.webkit.org/show_bug.cgi?id=156987

Reviewed by Chris Fleizach.

When we hit test on a slider indicator asking for the value when the parent slider's
accessibility object is not created or the parent slider has been removed, it will cause
crash. Fixed it by adding a check to see if the object is detached from the parent.

Test: accessibility/mac/slider-thumb-value-crash.html

* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

2016-04-25 Jer Noble <jer.noble@apple.com>

WebKitPlaybackSessionModelMediaElement should initialize the interface added by setWebPlaybackSessionInterface() with initial data
@@ -2561,6 +2561,9 @@ - (id)accessibilityAttributeValue:(NSString*)attributeName
if (![self updateObjectBackingStore])
return nil;

if (m_object->isDetachedFromParent())
return nil;

if ([attributeName isEqualToString: NSAccessibilityRoleAttribute])
return [self role];

0 comments on commit ffdd4e2

Please sign in to comment.