[webkit-changes] [WebKit/WebKit] b62e70: AX: Fix crashes in tests doctype-node-in-text-mark...

[Tyler Wilcock]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: b62e70f7035d66d10947c0d4b0826b5baeb288b9
      https://github.com/WebKit/WebKit/commit/b62e70f7035d66d10947c0d4b0826b5baeb288b9
  Author: Tyler Wilcock <tyler_w at apple.com>
  Date:   2025-01-21 (Tue, 21 Jan 2025)

  Changed paths:
    M Source/WebCore/accessibility/AXCoreObject.cpp
    M Source/WebCore/accessibility/AXCoreObject.h
    M Source/WebCore/accessibility/AXTextMarker.cpp
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp

  Log Message:
  -----------
  AX: Fix crashes in tests doctype-node-in-text-marker-crash.html, roles-computedRoleString.html, and roles-exposed.html in ENABLE(AX_THREAD_TEXT_APIS)
https://bugs.webkit.org/show_bug.cgi?id=286177
rdar://143159921

Reviewed by Chris Fleizach.

doctype-node-in-text-marker-crash.html failed because AXTextMarker::partialOrderByTraversal used findMarker to traverse
forwards and backwards to determine whether the given text marker was in front or behind of the |this| AXTextMarker.

This failed when either marker was not able to be turned into a text-leaf marker, since we would not find the other
marker forward or backwards, and hit a RELEASE_ASSERT_NOT_REACHED().

This commit fixes the issue by simply using nextInPreOrder and previousInPreOrder to find the object represented in
in the other marker. This is both more correct and more efficient, since we move entire objects at a time rather than
offset-by-offset.

roles-computedRoleString.html and roles-exposed.html are fixed by changing AccessibilityRenderObject::textRuns to not
unconditionally dereference InlineIterator::box. It is not guaranteed there is a box to use, so just return 0 for the
line index in this case.

* Source/WebCore/accessibility/AXCoreObject.cpp:
(WebCore::AXCoreObject::unignoredChildren):
(WebCore::AXCoreObject::nextInPreOrder):
(WebCore::AXCoreObject::previousInPreOrder):
(WebCore::AXCoreObject::supportsPressAction const):
* Source/WebCore/accessibility/AXCoreObject.h:
* Source/WebCore/accessibility/AXTextMarker.cpp:
(WebCore::AXTextMarker::paragraphRange const):
(WebCore::AXTextMarker::equivalentTextPosition const):
(WebCore::AXTextMarker::partialOrderByTraversal const):
* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::textRuns):

Canonical link: https://commits.webkit.org/289229@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications