Skip to content

GitLab

T
tangled
Commit 172a5b44 authored by Meredith Lane's avatar Meredith Lane Committed by Commit Bot
Browse files
Options

Fixes null dereference in AXLayoutObject. 

Clusterfuzz identified a null dereference on AXLayoutObject.

Bug: 970217
Change-Id: I269ba9bfce1d07e6af48a11bd9080279400ca965
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1666576
Commit-Queue: Meredith Lane <meredithl@chromium.org>
Reviewed-by: default avatarKinuko Yasuda <kinuko@chromium.org>
Reviewed-by: default avatarAlice Boxhall <aboxhall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#671984}
parent 9bb4fadf
Hide whitespace changes
Inline Side-by-side
Showing with 83 additions and 1 deletion
third_party/blink/renderer/modules/accessibility/ax_layout_object.cc
View file @ 172a5b44
...@@ -2780,8 +2780,11 @@ ax::mojom::Role AXLayoutObject::DetermineTableRowRole() const { ...@@ -2780,8 +2780,11 @@ ax::mojom::Role AXLayoutObject::DetermineTableRowRole() const {
if (!parent) if (!parent)
return ax::mojom::Role::kGenericContainer; return ax::mojom::Role::kGenericContainer;
if (parent->RoleValue() == ax::mojom::Role::kGroup) if (parent->RoleValue() == ax::mojom::Role::kGroup) {
parent = parent->ParentObjectUnignored(); parent = parent->ParentObjectUnignored();
if (!parent)
return ax::mojom::Role::kGenericContainer;
}
if (parent->RoleValue() == ax::mojom::Role::kLayoutTable) if (parent->RoleValue() == ax::mojom::Role::kLayoutTable)
return ax::mojom::Role::kLayoutTableRow; return ax::mojom::Role::kLayoutTableRow;
......
third_party/blink/web_tests/accessibility/table-row-role-crash.html 0 → 100644
View file @ 172a5b44
<style></style>
<script>
function jsfuzzer() {
var variableElement = document.getElementById("variableElement"); //HTMLUnknownElement
var templateElement = document.getElementById("templateElement"); //HTMLTemplateElement
var htmlFormElement = document.getElementById("htmlFormElement"); //HTMLFormElement
var createdVarElement = document.createElement("var"); //HTMLUnknownElement
document.all[7].appendChild(htmlBaseTag);
var createdTBodyElement = document.createElement("tbody");
createdTBodyElement.insertRow();
document.all[20].appendChild(createdTBodyElement);
document.all[13].appendChild(htmlLiElement);
// For some reason past here, not appending via modulo fails to induce a crash?
document.all[52 % document.all.length].appendChild(createdVarElement);
document.adoptNode(htmlDescriptionTag);
htmlFormElement.reset();
document.all[90 % document.all.length].appendChild(variableElement);
document.all[85 % document.all.length].appendChild(templateElement);
htmlFormElement.reset();
}
function eventhandler2() {
var htmlLiElement = document.getElementById("htmlLiElement"); //HTMLLIElement
var htmlContentTag = document.getElementById("htmlContentTag"); //HTMLContentElement
var htmlAreaTag = document.getElementById("htmlAreaTag"); //HTMLAreaElement
var htmlUnknownElement = document.getElementById("htmlUnknownElement"); //HTMLUnknownElement
var htmlParagraphElement = document.createElement("p"); //HTMLParagraphElement
var var00016 = window.getSelection();
var00016.selectAllChildren(templateElement);
document.all[51 % document.all.length].appendChild(htmlParagraphElement);
var var00036 = document.createElement("a");;
var var00039 = htmlLiElement.outerHTML;
var caretRange = document.caretRangeFromPoint();
caretRange.insertNode(templateElement);
var var00192 = var00016.extentNode;
var00016.selectAllChildren(var00192);
var00016.deleteFromDocument();
htmlLiElement.innerHTML = var00039;
document.all[82 % document.all.length].appendChild(htmlContentTag);
document.all[99 % document.all.length].appendChild(htmlUnknownElement);
document.all[36 % document.all.length].appendChild(var00036);
document.all[50 % document.all.length].appendChild(htmlAreaTag);
}
</script>
<body onload=jsfuzzer()>
<hr>
<ul>
<li>
<dl>
<dd id="htmlDescriptionTag"><dt declare="declare"</dt>
<li id="htmlLiElement"></li>
</ul>
<var id="variableElement">
<image><ol></ol>
</var>
<template id="templateElement">
</template>
<input>
<content id="htmlContentTag"></content>
<map>
<area id="htmlAreaTag" role="group" </area>
<area id="htmlvar00017"</area>
<form id="htmlFormElement" onreset="eventhandler2()">
<fieldset>
<textarea></textarea>
<label></label>
<h4></h4>
<link></p>
<base id="htmlBaseTag">
<div></div>
<noscript></noscript>
<basefont id="htmlUnknownElement"></basefont>
</fieldset>
</form>
</map>
</body>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment