[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373
cfleizach at apple.com
cfleizach at apple.com
Thu Apr 8 00:35:22 UTC 2010
The following commit has been merged in the webkit-1.2 branch:
commit a8992b9d239d574e169b8c3cb1b20218d1fa03ab
Author: cfleizach at apple.com <cfleizach at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Mon Dec 14 16:25:00 2009 +0000
AX: there's an infinite loop going on for some webpages - facebook.com
https://bugs.webkit.org/show_bug.cgi?id=32501
Reviewed by Adele Peterson.
WebCore:
The problem is that parentObjectUnignored() cannot be called
while in accessibilityIsIgnored, because it leads to
recursiveness. Specifically, there were checks to determine
if an object was within a ARIA tree. That check should
1) be moved to all platforms, and 2) not call parentObjectUnignored().
Test: accessibility/hang-in-isignored.html
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::isAllowedChildOfTree):
(WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
* accessibility/AccessibilityRenderObject.h:
* accessibility/mac/AccessibilityObjectMac.mm:
(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
LayoutTests:
* accessibility/hang-in-isignored-expected.txt: Added.
* accessibility/hang-in-isignored.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@52095 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 30f21a1..ae1a84a 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2009-12-14 Chris Fleizach <cfleizach at apple.com>
+
+ Reviewed by Adele Peterson.
+
+ AX: there's an infinite loop going on for some webpages - facebook.com
+ https://bugs.webkit.org/show_bug.cgi?id=32501
+
+ * accessibility/hang-in-isignored-expected.txt: Added.
+ * accessibility/hang-in-isignored.html: Added.
+
2009-12-14 Eric Carlson <eric.carlson at apple.com>
Reviewed by Dan Bernstein.
diff --git a/LayoutTests/accessibility/hang-in-isignored-expected.txt b/LayoutTests/accessibility/hang-in-isignored-expected.txt
new file mode 100644
index 0000000..a004548
--- /dev/null
+++ b/LayoutTests/accessibility/hang-in-isignored-expected.txt
@@ -0,0 +1,40 @@
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test
+test test test test test test test test test test test test test test test test test test test test test test test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+test test test test
+This tests that we will not hang when using accessibility on this page. The idea is that the element tree is deep enough to cause a hang just by accessing elements if something is implemented incorrectly.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/hang-in-isignored.html b/LayoutTests/accessibility/hang-in-isignored.html
new file mode 100644
index 0000000..d6bb0bc
--- /dev/null
+++ b/LayoutTests/accessibility/hang-in-isignored.html
@@ -0,0 +1,94 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
+<script>
+var successfullyParsed = false;
+</script>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+
+<body id="body">
+
+<div role="group">test
+ <div role="group"><span>test
+ <div role="group"><span>test
+ <div role="group"><span>test
+ <div role="group"><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <div><span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <span>test
+ <table border=1>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ <tr><td>test</td><td>test</td><td>test</td><td>test</td></tr>
+ </table>
+
+</div>
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+ description("This tests that we will not hang when using accessibility on this page. The idea is that the element tree is deep enough to cause a hang just by accessing elements if something is implemented incorrectly.");
+
+ if (window.accessibilityController) {
+
+ document.getElementById("body").focus();
+ var body = accessibilityController.focusedElement;
+
+ // if successful, we will NOT hang after this call
+ body.childAtIndex(0).childAtIndex(0);
+ }
+
+ successfullyParsed = true;
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 25f866d..c2e818e 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,25 @@
+2009-12-14 Chris Fleizach <cfleizach at apple.com>
+
+ Reviewed by Adele Peterson.
+
+ AX: there's an infinite loop going on for some webpages - facebook.com
+ https://bugs.webkit.org/show_bug.cgi?id=32501
+
+ The problem is that parentObjectUnignored() cannot be called
+ while in accessibilityIsIgnored, because it leads to
+ recursiveness. Specifically, there were checks to determine
+ if an object was within a ARIA tree. That check should
+ 1) be moved to all platforms, and 2) not call parentObjectUnignored().
+
+ Test: accessibility/hang-in-isignored.html
+
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::AccessibilityRenderObject::isAllowedChildOfTree):
+ (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+ * accessibility/AccessibilityRenderObject.h:
+ * accessibility/mac/AccessibilityObjectMac.mm:
+ (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+
2009-12-14 Eric Carlson <eric.carlson at apple.com>
Reviewed by Dan Bernstein.
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index c57dd92..a235b92 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1399,6 +1399,28 @@ bool AccessibilityRenderObject::isDescendantOfBarrenParent() const
return false;
}
+bool AccessibilityRenderObject::isAllowedChildOfTree() const
+{
+ // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
+ AccessibilityObject* axObj = parentObject();
+ bool isInTree = false;
+ while (axObj) {
+ if (axObj->isTree()) {
+ isInTree = true;
+ break;
+ }
+ axObj = axObj->parentObject();
+ }
+
+ // If the object is in a tree, only tree items should be exposed (and the children of tree items).
+ if (isInTree) {
+ AccessibilityRole role = roleValue();
+ if (role != TreeItemRole && role != StaticTextRole)
+ return false;
+ }
+ return true;
+}
+
bool AccessibilityRenderObject::accessibilityIsIgnored() const
{
// Is the platform interested in this object?
@@ -1426,6 +1448,10 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
if (roleValue() == IgnoredRole)
return true;
+ // An ARIA tree can only have tree items and static text as children.
+ if (!isAllowedChildOfTree())
+ return true;
+
// ignore popup menu items because AppKit does
for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
if (parent->isMenuList())
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index d537881..58aa557 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -264,6 +264,7 @@ private:
void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
bool ariaIsHidden() const;
bool isDescendantOfBarrenParent() const;
+ bool isAllowedChildOfTree() const;
bool hasTextAlternative() const;
String positionalDescriptionForMSAA() const;
diff --git a/WebCore/accessibility/mac/AccessibilityObjectMac.mm b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
index 722b03e..217af54 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectMac.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
@@ -43,24 +43,6 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
{
- // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
- AccessibilityObject* axObj = parentObject();
- bool isInTree = false;
- while (axObj) {
- if (axObj->isTree()) {
- isInTree = true;
- break;
- }
- axObj = axObj->parentObjectUnignored();
- }
-
- // If the object is in a tree, only tree items should be exposed (and the children of tree items).
- if (isInTree) {
- AccessibilityRole role = roleValue();
- if (role != TreeItemRole && role != StaticTextRole)
- return IgnoreObject;
- }
-
return DefaultBehavior;
}
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list