<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[163586] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/163586">163586</a></dd>
<dt>Author</dt> <dd>cfleizach@apple.com</dd>
<dt>Date</dt> <dd>2014-02-06 17:29:33 -0800 (Thu, 06 Feb 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>AX: Crash in WebCore::AXObjectCache::computedObjectAttributeCache
https://bugs.webkit.org/show_bug.cgi?id=128310
Reviewed by Alexey Proskuryakov.
Be more careful about using axObjectCache() directly since it can return null.
I audited the usage cases of this method and ensured the ptr was not null in cases
where I thought we might get hit by this.
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::parentObject):
(WebCore::AccessibilityNodeObject::menuForMenuButton):
(WebCore::AccessibilityNodeObject::menuButtonForMenu):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
(WebCore::AccessibilityObject::findMatchingObjects):
(WebCore::AccessibilityObject::elementAccessibilityHitTest):
(WebCore::AccessibilityObject::axObjectCache):
(WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
(WebCore::AccessibilityObject::accessibilityIsIgnored):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::parentObjectIfExists):
(WebCore::AccessibilityRenderObject::parentObject):
(WebCore::AccessibilityRenderObject::anchorElement):
(WebCore::AccessibilityRenderObject::isTabItemSelected):
(WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
(WebCore::AccessibilityRenderObject::nodeIsTextControl):
(WebCore::AccessibilityRenderObject::activeDescendant):
(WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):
(WebCore::AccessibilityRenderObject::observableObject):
(WebCore::AccessibilityRenderObject::textChanged):
* accessibility/AccessibilityScrollView.cpp:
(WebCore::AccessibilityScrollView::addChildScrollbar):
(WebCore::AccessibilityScrollView::webAreaObject):
(WebCore::AccessibilityScrollView::parentObject):
(WebCore::AccessibilityScrollView::parentObjectIfExists):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityNodeObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityObject.cpp</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityScrollViewcpp">trunk/Source/WebCore/accessibility/AccessibilityScrollView.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (163585 => 163586)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-02-07 01:21:07 UTC (rev 163585)
+++ trunk/Source/WebCore/ChangeLog 2014-02-07 01:29:33 UTC (rev 163586)
</span><span class="lines">@@ -1,3 +1,42 @@
</span><ins>+2014-02-06 Chris Fleizach <cfleizach@apple.com>
+
+ AX: Crash in WebCore::AXObjectCache::computedObjectAttributeCache
+ https://bugs.webkit.org/show_bug.cgi?id=128310
+
+ Reviewed by Alexey Proskuryakov.
+
+ Be more careful about using axObjectCache() directly since it can return null.
+ I audited the usage cases of this method and ensured the ptr was not null in cases
+ where I thought we might get hit by this.
+
+ * accessibility/AccessibilityNodeObject.cpp:
+ (WebCore::AccessibilityNodeObject::parentObject):
+ (WebCore::AccessibilityNodeObject::menuForMenuButton):
+ (WebCore::AccessibilityNodeObject::menuButtonForMenu):
+ * accessibility/AccessibilityObject.cpp:
+ (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
+ (WebCore::AccessibilityObject::findMatchingObjects):
+ (WebCore::AccessibilityObject::elementAccessibilityHitTest):
+ (WebCore::AccessibilityObject::axObjectCache):
+ (WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
+ (WebCore::AccessibilityObject::accessibilityIsIgnored):
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+ (WebCore::AccessibilityRenderObject::parentObject):
+ (WebCore::AccessibilityRenderObject::anchorElement):
+ (WebCore::AccessibilityRenderObject::isTabItemSelected):
+ (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+ (WebCore::AccessibilityRenderObject::nodeIsTextControl):
+ (WebCore::AccessibilityRenderObject::activeDescendant):
+ (WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):
+ (WebCore::AccessibilityRenderObject::observableObject):
+ (WebCore::AccessibilityRenderObject::textChanged):
+ * accessibility/AccessibilityScrollView.cpp:
+ (WebCore::AccessibilityScrollView::addChildScrollbar):
+ (WebCore::AccessibilityScrollView::webAreaObject):
+ (WebCore::AccessibilityScrollView::parentObject):
+ (WebCore::AccessibilityScrollView::parentObjectIfExists):
+
</ins><span class="cx"> 2014-02-06 Zoltan Horvath <zoltan@webkit.org>
</span><span class="cx">
</span><span class="cx"> [CSS Shapes] Rounded Insets Let Content Overlap Shape
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityNodeObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp (163585 => 163586)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp 2014-02-07 01:21:07 UTC (rev 163585)
+++ trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp 2014-02-07 01:29:33 UTC (rev 163586)
</span><span class="lines">@@ -228,9 +228,12 @@
</span><span class="cx"> return 0;
</span><span class="cx">
</span><span class="cx"> Node* parentObj = node()->parentNode();
</span><del>- if (parentObj)
- return axObjectCache()->getOrCreate(parentObj);
</del><ins>+ if (!parentObj)
+ return nullptr;
</ins><span class="cx">
</span><ins>+ if (AXObjectCache* cache = axObjectCache())
+ return cache->getOrCreate(parentObj);
+
</ins><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1204,7 +1207,9 @@
</span><span class="cx">
</span><span class="cx"> AccessibilityObject* AccessibilityNodeObject::menuForMenuButton() const
</span><span class="cx"> {
</span><del>- return axObjectCache()->getOrCreate(menuElementForMenuButton());
</del><ins>+ if (AXObjectCache* cache = axObjectCache())
+ return cache->getOrCreate(menuElementForMenuButton());
+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Element* AccessibilityNodeObject::menuItemElementForMenu() const
</span><span class="lines">@@ -1217,11 +1222,15 @@
</span><span class="cx">
</span><span class="cx"> AccessibilityObject* AccessibilityNodeObject::menuButtonForMenu() const
</span><span class="cx"> {
</span><ins>+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return nullptr;
+
</ins><span class="cx"> Element* menuItem = menuItemElementForMenu();
</span><span class="cx">
</span><span class="cx"> if (menuItem) {
</span><span class="cx"> // ARIA just has generic menu items. AppKit needs to know if this is a top level items like MenuBarButton or MenuBarItem
</span><del>- AccessibilityObject* menuItemAX = axObjectCache()->getOrCreate(menuItem);
</del><ins>+ AccessibilityObject* menuItemAX = cache->getOrCreate(menuItem);
</ins><span class="cx"> if (menuItemAX && menuItemAX->isMenuButton())
</span><span class="cx"> return menuItemAX;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityObject.cpp (163585 => 163586)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityObject.cpp 2014-02-07 01:21:07 UTC (rev 163585)
+++ trunk/Source/WebCore/accessibility/AccessibilityObject.cpp 2014-02-07 01:29:33 UTC (rev 163586)
</span><span class="lines">@@ -377,7 +377,9 @@
</span><span class="cx"> return 0;
</span><span class="cx">
</span><span class="cx"> AXObjectCache* cache = node->document().axObjectCache();
</span><del>-
</del><ins>+ if (!cache)
+ return nullptr;
+
</ins><span class="cx"> AccessibilityObject* accessibleObject = cache->getOrCreate(node->renderer());
</span><span class="cx"> while (accessibleObject && accessibleObject->accessibilityIsIgnored()) {
</span><span class="cx"> node = NodeTraversal::next(node);
</span><span class="lines">@@ -463,7 +465,8 @@
</span><span class="cx"> if (!criteria)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- axObjectCache()->startCachingComputedObjectAttributesUntilTreeMutates();
</del><ins>+ if (AXObjectCache* cache = axObjectCache())
+ cache->startCachingComputedObjectAttributesUntilTreeMutates();
</ins><span class="cx">
</span><span class="cx"> // This search mechanism only searches the elements before/after the starting object.
</span><span class="cx"> // It does this by stepping up the parent chain and at each level doing a DFS.
</span><span class="lines">@@ -1660,8 +1663,10 @@
</span><span class="cx"> if (isAttachment()) {
</span><span class="cx"> Widget* widget = widgetForAttachmentView();
</span><span class="cx"> // Normalize the point for the widget's bounds.
</span><del>- if (widget && widget->isFrameView())
- return axObjectCache()->getOrCreate(widget)->accessibilityHitTest(IntPoint(point - widget->frameRect().location()));
</del><ins>+ if (widget && widget->isFrameView()) {
+ if (AXObjectCache* cache = axObjectCache())
+ return cache->getOrCreate(widget)->accessibilityHitTest(IntPoint(point - widget->frameRect().location()));
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Check if there are any mock elements that need to be handled.
</span><span class="lines">@@ -1678,7 +1683,7 @@
</span><span class="cx"> Document* doc = document();
</span><span class="cx"> if (doc)
</span><span class="cx"> return doc->axObjectCache();
</span><del>- return 0;
</del><ins>+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> AccessibilityObject* AccessibilityObject::focusedUIElement() const
</span><span class="lines">@@ -2017,7 +2022,8 @@
</span><span class="cx"> {
</span><span class="cx"> bool isIgnored = accessibilityIsIgnored();
</span><span class="cx"> if (lastKnownIsIgnoredValue() != isIgnored) {
</span><del>- axObjectCache()->childrenChanged(parentObject());
</del><ins>+ if (AXObjectCache* cache = axObjectCache())
+ cache->childrenChanged(parentObject());
</ins><span class="cx"> setLastKnownIsIgnoredValue(isIgnored);
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -2102,7 +2108,10 @@
</span><span class="cx">
</span><span class="cx"> bool AccessibilityObject::accessibilityIsIgnored() const
</span><span class="cx"> {
</span><del>- AXComputedObjectAttributeCache* attributeCache = axObjectCache()->computedObjectAttributeCache();
</del><ins>+ AXComputedObjectAttributeCache* attributeCache = nullptr;
+ if (AXObjectCache* cache = axObjectCache())
+ attributeCache = cache->computedObjectAttributeCache();
+
</ins><span class="cx"> if (attributeCache) {
</span><span class="cx"> AccessibilityObjectInclusion ignored = attributeCache->getIgnored(axObjectID());
</span><span class="cx"> switch (ignored) {
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (163585 => 163586)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2014-02-07 01:21:07 UTC (rev 163585)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2014-02-07 01:29:33 UTC (rev 163586)
</span><span class="lines">@@ -476,11 +476,15 @@
</span><span class="cx">
</span><span class="cx"> AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
</span><span class="cx"> {
</span><ins>+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return nullptr;
+
</ins><span class="cx"> // WebArea's parent should be the scroll view containing it.
</span><span class="cx"> if (isWebArea())
</span><del>- return axObjectCache()->get(&m_renderer->view().frameView());
</del><ins>+ return cache->get(&m_renderer->view().frameView());
</ins><span class="cx">
</span><del>- return axObjectCache()->get(renderParentObject());
</del><ins>+ return cache->get(renderParentObject());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> AccessibilityObject* AccessibilityRenderObject::parentObject() const
</span><span class="lines">@@ -498,13 +502,17 @@
</span><span class="cx"> return parent;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return nullptr;
+
</ins><span class="cx"> RenderObject* parentObj = renderParentObject();
</span><span class="cx"> if (parentObj)
</span><del>- return axObjectCache()->getOrCreate(parentObj);
</del><ins>+ return cache->getOrCreate(parentObj);
</ins><span class="cx">
</span><span class="cx"> // WebArea's parent should be the scroll view containing it.
</span><span class="cx"> if (isWebArea())
</span><del>- return axObjectCache()->getOrCreate(&m_renderer->view().frameView());
</del><ins>+ return cache->getOrCreate(&m_renderer->view().frameView());
</ins><span class="cx">
</span><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="lines">@@ -562,6 +570,9 @@
</span><span class="cx"> return 0;
</span><span class="cx">
</span><span class="cx"> AXObjectCache* cache = axObjectCache();
</span><ins>+ if (!cache)
+ return nullptr;
+
</ins><span class="cx"> RenderObject* currRenderer;
</span><span class="cx">
</span><span class="cx"> // Search up the render tree for a RenderObject with a DOM node. Defer to an earlier continuation, though.
</span><span class="lines">@@ -1587,8 +1598,12 @@
</span><span class="cx"> Vector<Element*> elements;
</span><span class="cx"> elementsFromAttribute(elements, aria_controlsAttr);
</span><span class="cx">
</span><ins>+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return false;
+
</ins><span class="cx"> for (const auto& element : elements) {
</span><del>- AccessibilityObject* tabPanel = axObjectCache()->getOrCreate(element);
</del><ins>+ AccessibilityObject* tabPanel = cache->getOrCreate(element);
</ins><span class="cx">
</span><span class="cx"> // A tab item should only control tab panels.
</span><span class="cx"> if (!tabPanel || tabPanel->roleValue() != TabPanelRole)
</span><span class="lines">@@ -1731,7 +1746,10 @@
</span><span class="cx"> if (!imageElement)
</span><span class="cx"> return 0;
</span><span class="cx">
</span><del>- return axObjectCache()->getOrCreate(imageElement);
</del><ins>+ if (AXObjectCache* cache = axObjectCache())
+ return cache->getOrCreate(imageElement);
+
+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void AccessibilityRenderObject::getDocumentLinks(AccessibilityChildrenVector& result)
</span><span class="lines">@@ -1902,11 +1920,12 @@
</span><span class="cx"> if (!node)
</span><span class="cx"> return false;
</span><span class="cx">
</span><del>- const AccessibilityObject* axObjectForNode = axObjectCache()->getOrCreate(const_cast<Node*>(node));
- if (!axObjectForNode)
- return false;
</del><ins>+ if (AXObjectCache* cache = axObjectCache()) {
+ if (AccessibilityObject* axObjectForNode = cache->getOrCreate(const_cast<Node*>(node)))
+ return axObjectForNode->isTextControl();
+ }
</ins><span class="cx">
</span><del>- return axObjectForNode->isTextControl();
</del><ins>+ return false;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> IntRect AccessibilityRenderObject::boundsForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
</span><span class="lines">@@ -2276,10 +2295,13 @@
</span><span class="cx"> if (!target)
</span><span class="cx"> return 0;
</span><span class="cx">
</span><del>- AccessibilityObject* obj = axObjectCache()->getOrCreate(target);
- if (obj && obj->isAccessibilityRenderObject())
- // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
- return obj;
</del><ins>+ if (AXObjectCache* cache = axObjectCache()) {
+ AccessibilityObject* obj = cache->getOrCreate(target);
+ if (obj && obj->isAccessibilityRenderObject())
+ // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
+ return obj;
+ }
+
</ins><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2309,12 +2331,16 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Post that the row count changed.
</span><ins>+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return;
+
</ins><span class="cx"> if (containerParent)
</span><del>- axObjectCache()->postNotification(containerParent, document(), AXObjectCache::AXRowCountChanged);
</del><ins>+ cache->postNotification(containerParent, document(), AXObjectCache::AXRowCountChanged);
</ins><span class="cx">
</span><span class="cx"> // Post that the specific row either collapsed or expanded.
</span><span class="cx"> if (roleValue() == RowRole || roleValue() == TreeItemRole)
</span><del>- axObjectCache()->postNotification(this, document(), isExpanded() ? AXObjectCache::AXRowExpanded : AXObjectCache::AXRowCollapsed);
</del><ins>+ cache->postNotification(this, document(), isExpanded() ? AXObjectCache::AXRowExpanded : AXObjectCache::AXRowCollapsed);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void AccessibilityRenderObject::handleActiveDescendantChanged()
</span><span class="lines">@@ -2388,8 +2414,10 @@
</span><span class="cx"> {
</span><span class="cx"> // Find the object going up the parent chain that is used in accessibility to monitor certain notifications.
</span><span class="cx"> for (RenderObject* renderer = m_renderer; renderer && renderer->node(); renderer = renderer->parent()) {
</span><del>- if (renderObjectIsObservable(renderer))
- return axObjectCache()->getOrCreate(renderer);
</del><ins>+ if (renderObjectIsObservable(renderer)) {
+ if (AXObjectCache* cache = axObjectCache())
+ return cache->getOrCreate(renderer);
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> return 0;
</span><span class="lines">@@ -2714,6 +2742,9 @@
</span><span class="cx"> // If this element supports ARIA live regions, or is part of a region with an ARIA editable role,
</span><span class="cx"> // then notify the AT of changes.
</span><span class="cx"> AXObjectCache* cache = axObjectCache();
</span><ins>+ if (!cache)
+ return;
+
</ins><span class="cx"> for (RenderObject* renderParent = m_renderer; renderParent; renderParent = renderParent->parent()) {
</span><span class="cx"> AccessibilityObject* parent = cache->get(renderParent);
</span><span class="cx"> if (!parent)
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityScrollViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityScrollView.cpp (163585 => 163586)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityScrollView.cpp 2014-02-07 01:21:07 UTC (rev 163585)
+++ trunk/Source/WebCore/accessibility/AccessibilityScrollView.cpp 2014-02-07 01:29:33 UTC (rev 163586)
</span><span class="lines">@@ -149,7 +149,11 @@
</span><span class="cx"> if (!scrollbar)
</span><span class="cx"> return 0;
</span><span class="cx">
</span><del>- AccessibilityScrollbar* scrollBarObject = toAccessibilityScrollbar(axObjectCache()->getOrCreate(scrollbar));
</del><ins>+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return nullptr;
+
+ AccessibilityScrollbar* scrollBarObject = toAccessibilityScrollbar(cache->getOrCreate(scrollbar));
</ins><span class="cx"> scrollBarObject->setParent(this);
</span><span class="cx"> m_children.append(scrollBarObject);
</span><span class="cx"> return scrollBarObject;
</span><span class="lines">@@ -192,7 +196,10 @@
</span><span class="cx"> if (!doc || !doc->hasLivingRenderTree())
</span><span class="cx"> return 0;
</span><span class="cx">
</span><del>- return axObjectCache()->getOrCreate(doc);
</del><ins>+ if (AXObjectCache* cache = axObjectCache())
+ return cache->getOrCreate(doc);
+
+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> AccessibilityObject* AccessibilityScrollView::accessibilityHitTest(const IntPoint& point) const
</span><span class="lines">@@ -229,10 +236,14 @@
</span><span class="cx"> {
</span><span class="cx"> if (!m_scrollView || !m_scrollView->isFrameView())
</span><span class="cx"> return 0;
</span><del>-
</del><ins>+
+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return nullptr;
+
</ins><span class="cx"> HTMLFrameOwnerElement* owner = toFrameView(m_scrollView)->frame().ownerElement();
</span><span class="cx"> if (owner && owner->renderer())
</span><del>- return axObjectCache()->getOrCreate(owner);
</del><ins>+ return cache->getOrCreate(owner);
</ins><span class="cx">
</span><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="lines">@@ -242,9 +253,13 @@
</span><span class="cx"> if (!m_scrollView || !m_scrollView->isFrameView())
</span><span class="cx"> return 0;
</span><span class="cx">
</span><ins>+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return nullptr;
+
</ins><span class="cx"> HTMLFrameOwnerElement* owner = toFrameView(m_scrollView)->frame().ownerElement();
</span><span class="cx"> if (owner && owner->renderer())
</span><del>- return axObjectCache()->get(owner);
</del><ins>+ return cache->get(owner);
</ins><span class="cx">
</span><span class="cx"> return 0;
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>