[Webkit-unassigned] [Bug 153553] AX: Crash in AccessibilityTableColumn::headerObject

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=153553

--- Comment #3 from chris fleizach <cfleizach at apple.com> ---
Comment on attachment 270016
  --> https://bugs.webkit.org/attachment.cgi?id=270016
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=270016&action=review

> Source/WebCore/ChangeLog:12
> +        function calls elementRect() for each child cell and that sometimes cause 

sometimes "causes"

> Source/WebCore/accessibility/AccessibilityTable.cpp:506
> +    AccessibilityChildrenVector columnsCopy  = m_columns;

bad spacing.

> Source/WebCore/accessibility/AccessibilityTable.cpp:522
> +    AccessibilityChildrenVector rowsCopy  = m_rows;

bad spacing

> Source/WebCore/accessibility/AccessibilityTableColumn.cpp:66
> +    // This was calculated and cached in addChildren() previously, however sometimes elementRect()

change comment to something like

"This used to be cached during the call to addChildren(), but calling elementRect() can invalidate elements, so its better to ask for this on demand"

> Source/WebCore/accessibility/AccessibilityTableColumn.cpp:71
> +    for (const auto& cell : m_children)

should we make a copy of m_children here in case it invalidates something

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160127/58c9e8e3/attachment.html>