[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.15.1-1414-gc69ee75

Thu Oct 29 20:52:04 UTC 2009

The following commit has been merged in the webkit-1.1 branch:
commit e0a5d74f5caa193f1f8283a532a1298173ee1bc8
Author: cfleizach at apple.com <cfleizach at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Oct 26 14:49:50 2009 +0000

    crash with AX on when an image map contains an anchor tag
    https://bugs.webkit.org/show_bug.cgi?id=30739
    
    Reviewed by Darin Adler.
    
    WebCore:
    
    Tests: accessibility/crashing-a-tag-in-map.html
    
    * accessibility/AccessibilityRenderObject.cpp:
    (WebCore::AccessibilityRenderObject::addChildren):
    
    LayoutTests:
    
    * accessibility/crashing-a-tag-in-map-expected.txt: Added.
    * accessibility/crashing-a-tag-in-map.html: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@50062 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index f46b147..b11fc99 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2009-10-26  Chris Fleizach  <cfleizach at apple.com>
+
+        Reviewed by Darin Adler.
+
+        crash with AX on when an image map contains an anchor tag
+        https://bugs.webkit.org/show_bug.cgi?id=30739
+
+        * accessibility/crashing-a-tag-in-map-expected.txt: Added.
+        * accessibility/crashing-a-tag-in-map.html: Added.
+
 2009-10-26  Csaba Osztrogonác  <ossy at webkit.org>
 
         Rubber-stamped by Tor Arne Vestbø.
diff --git a/LayoutTests/accessibility/crashing-a-tag-in-map-expected.txt b/LayoutTests/accessibility/crashing-a-tag-in-map-expected.txt
new file mode 100644
index 0000000..e2e8902
--- /dev/null
+++ b/LayoutTests/accessibility/crashing-a-tag-in-map-expected.txt
@@ -0,0 +1,10 @@
+
+This tests that a hit test on a image map that has areas and anchors does not crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/crashing-a-tag-in-map.html b/LayoutTests/accessibility/crashing-a-tag-in-map.html
new file mode 100644
index 0000000..970687b
--- /dev/null
+++ b/LayoutTests/accessibility/crashing-a-tag-in-map.html
@@ -0,0 +1,43 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
+<script>
+var successfullyParsed = false;
+</script>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<div class="body">
+
+<img src="resources/cake.png" height="500" width="613" border="0" usemap="#img">
+<map id="img" name="img">
+<area shape="rect" coords="97,45,5,5" href="test.html" alt="">
+<area shape="rect" coords="447,45,5,5" href="test.html">
+<a href="test.html"></a>
+<area shape="default" nohref="nohref" alt="">
+</map></div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests that a hit test on a image map that has areas and anchors does not crash");
+
+    if (window.accessibilityController) {
+
+          var body = document.getElementById("body");
+          body.focus();
+
+          // test fails if it crashes here
+          var control = accessibilityController.focusedElement.elementAtPoint(100, 100);
+    }
+
+    successfullyParsed = true;
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 483e0ee..def552e 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2009-10-26  Chris Fleizach  <cfleizach at apple.com>
+
+        Reviewed by Darin Adler.
+
+        crash with AX on when an image map contains an anchor tag
+        https://bugs.webkit.org/show_bug.cgi?id=30739
+
+        Tests: accessibility/crashing-a-tag-in-map.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::addChildren):
+
 2009-10-26  Steve Block  <steveblock at google.com>
 
         Reviewed by Eric Seidel.
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index 234180b..4072541 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -2580,7 +2580,7 @@ void AccessibilityRenderObject::addChildren()
             for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
 
                 // add an <area> element for this child if it has a link
-                if (current->isLink()) {
+                if (current->hasTagName(areaTag) && current->isLink()) {
                     AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->getOrCreate(ImageMapLinkRole));
                     areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(current));
                     areaObject->setHTMLMapElement(map);

-- 
WebKit Debian packaging

