[Webkit-unassigned] [Bug 109449] ASSERTION FAILED: cellObject->isTableCell(), UNKNOWN in WebCore::AccessibilityTable::cellForColumnAndRow

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=109449





--- Comment #10 from chris fleizach <cfleizach at apple.com>  2013-02-12 15:29:04 PST ---
(In reply to comment #9)
> (In reply to comment #8)
> > (In reply to comment #7)
> > > (In reply to comment #5)
> > > > (In reply to comment #4)
> > > > > I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert.
> > > > 
> > > > I think the object coming back is the right kind of class, but it returns false for isTableCell because its ignored. That might be wrong I don't have code in front of me.
> > > 
> > > We need confirmation on this. Since that determines whether it is a security bug or not :)
> > 
> > Yea not a security bug in this specific case. the object is still the right class.
> 
> Thanks a lot. fixed flags. In normal rendering land, we don't have this kind of confusion. You might want to fix more of these kind of asserts in accessibility where accessibilityIsIgnored makes sure but also not hide a bad cast bug.

Yea i agree, this section could be handled more cleanly

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.