[Webkit-unassigned] [Bug 138566] AX: Add support for ARIA 1.1 attribute 'aria-modal' for dialog and alertdialog
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Nov 2 11:37:09 PST 2015
https://bugs.webkit.org/show_bug.cgi?id=138566
--- Comment #15 from chris fleizach <cfleizach at apple.com> ---
Comment on attachment 264467
--> https://bugs.webkit.org/attachment.cgi?id=264467
patch
View in context: https://bugs.webkit.org/attachment.cgi?id=264467&action=review
>>>> Source/WebCore/accessibility/AXObjectCache.cpp:145
>>>> + , m_currentAriaModalNode(nullptr)
>>>
>>> we should remove the pointer to m_currentAriaModalNode in our method that detects when nodes disappear.
>>> you can imagine if someone removed a tree that contains m_currentAriaModalNode, we could have a stale pointer
>>
>> In ariaModalNode() to get the current modal node, isNodeVisible(m_currentAriaModalNode) will check if the node is still there and set it to nullptr in updateCurrentAriaModalNode(). So that makes sure we are not accessing a stale pointer. Do you think that's enough?
>
> In ariaModalNode() to get the current modal node, isNodeVisible(m_currentAriaModalNode) will check if the node is still there and set it to nullptr in updateCurrentAriaModalNode(). So that makes sure we are not accessing a stale pointer. Do you think that's enough?
i don't think so. this call will cause a segfault
!is<Element>(node))
because node will be garbage memory
we should also add a test for this case
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151102/87546fbd/attachment.html>
More information about the webkit-unassigned
mailing list