<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[205865] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/205865">205865</a></dd>
<dt>Author</dt> <dd>n_wang@apple.com</dd>
<dt>Date</dt> <dd>2016-09-13 11:20:28 -0700 (Tue, 13 Sep 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>AX: Crash at AccessibilityRenderObject::computeAccessibilityIsIgnored const + 552
https://bugs.webkit.org/show_bug.cgi?id=161276
Reviewed by Chris Fleizach.
Sometimes when calling JavaScript removeChild or setAttribute on a node, it seems like
the renderer is deallocated during the process of computeAccessibilityIsIgnored. It's
causing a crash when we are accessing the renderer after that. Since RenderObject is not ref
counted and we cannot hold onto it for the duration of the function, fixed it by adding
more nil checks.
Despite my best efforts, I couldn't make a layout test that destroys the renderer within
the computeAccessibilityIsIgnored function.
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (205864 => 205865)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-09-13 17:53:25 UTC (rev 205864)
+++ trunk/Source/WebCore/ChangeLog 2016-09-13 18:20:28 UTC (rev 205865)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2016-09-13 Nan Wang <n_wang@apple.com>
+
+ AX: Crash at AccessibilityRenderObject::computeAccessibilityIsIgnored const + 552
+ https://bugs.webkit.org/show_bug.cgi?id=161276
+
+ Reviewed by Chris Fleizach.
+
+ Sometimes when calling JavaScript removeChild or setAttribute on a node, it seems like
+ the renderer is deallocated during the process of computeAccessibilityIsIgnored. It's
+ causing a crash when we are accessing the renderer after that. Since RenderObject is not ref
+ counted and we cannot hold onto it for the duration of the function, fixed it by adding
+ more nil checks.
+
+ Despite my best efforts, I couldn't make a layout test that destroys the renderer within
+ the computeAccessibilityIsIgnored function.
+
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
+
</ins><span class="cx"> 2016-09-12 Jer Noble <jer.noble@apple.com>
</span><span class="cx">
</span><span class="cx"> Media-source backed elements block load event; cause web-platform-test flakiness
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (205864 => 205865)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2016-09-13 17:53:25 UTC (rev 205864)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2016-09-13 18:20:28 UTC (rev 205865)
</span><span class="lines">@@ -1189,6 +1189,10 @@
</span><span class="cx"> AccessibilityObject* controlObject = correspondingControlForLabelElement();
</span><span class="cx"> if (controlObject && !controlObject->exposesTitleUIElement() && controlObject->isCheckboxOrRadio())
</span><span class="cx"> return true;
</span><ins>+
+ // https://webkit.org/b/161276 Getting the controlObject might cause the m_renderer to be nullptr.
+ if (!m_renderer)
+ return true;
</ins><span class="cx">
</span><span class="cx"> if (m_renderer->isBR())
</span><span class="cx"> return true;
</span><span class="lines">@@ -1208,6 +1212,10 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // Walking up the parent chain might reset the m_renderer.
+ if (!m_renderer)
+ return true;
+
</ins><span class="cx"> // The alt attribute may be set on a text fragment through CSS, which should be honored.
</span><span class="cx"> if (is<RenderTextFragment>(renderText)) {
</span><span class="cx"> AccessibilityObjectInclusion altTextInclusion = objectInclusionFromAltText(downcast<RenderTextFragment>(renderText).altText());
</span></span></pre>
</div>
</div>
</body>
</html>