Skip to content

GitLab

T
tangled
Commit 87247c95 authored by Jacques Newman's avatar Jacques Newman Committed by Commit Bot
Browse files
Options

Null check before dereferencing the return of GetOrCreate(LayoutObject*) 

GetOrCreate(LayoutObject*) can return nullptr if the node is an area
element. Added null check.

Bug: 996451
Change-Id: Id94b88dcdd521b98abdc24cd17e907801b79ae7b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1774828Reviewed-by: default avatarKevin Babbitt <kbabbitt@microsoft.com>
Reviewed-by: default avatarAaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Jacques Newman <janewman@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#691814}
parent 2ad77913
Hide whitespace changes
Inline Side-by-side
Showing with 38 additions and 3 deletions
content/browser/accessibility/dump_accessibility_tree_browsertest.cc
View file @ 87247c95
...@@ -311,6 +311,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityArea) { ...@@ -311,6 +311,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityArea) {
RunHtmlTest(FILE_PATH_LITERAL("area.html")); RunHtmlTest(FILE_PATH_LITERAL("area.html"));
} }
IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAreaCrash) {
RunHtmlTest(FILE_PATH_LITERAL("area-crash.html"));
}
IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAName) { IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAName) {
RunHtmlTest(FILE_PATH_LITERAL("a-name.html")); RunHtmlTest(FILE_PATH_LITERAL("a-name.html"));
} }
......
content/test/data/accessibility/html/area-crash-expected-blink.txt 0 → 100644
View file @ 87247c95
rootWebArea
++genericContainer
++++link name='foo'
++++++staticText name='foo'
++++++++inlineTextBox name='foo'
++++staticText name=' '
++++++inlineTextBox name=' '
++++staticText name='done'
++++++inlineTextBox name='done'
content/test/data/accessibility/html/area-crash.html 0 → 100644
View file @ 87247c95
<!--
@WAIT-FOR:done
This is a regression test for a bug that crashes when determining if an area is
a descendant of an anchor.
-->
<html>
<script>
window.onload = () => {
document.getElementById('area').textContent = "foo";
document.body.appendChild(document.createTextNode("done"));
};
</script>
<body>
<area id='area'/>
</body>
\ No newline at end of file
third_party/blink/renderer/modules/accessibility/ax_layout_object.cc
View file @ 87247c95
...@@ -2187,10 +2187,14 @@ Element* AXLayoutObject::AnchorElement() const { ...@@ -2187,10 +2187,14 @@ Element* AXLayoutObject::AnchorElement() const {
if (!node) if (!node)
return nullptr; return nullptr;
for (Node& runner : NodeTraversal::InclusiveAncestorsOf(*node)) { for (Node& runner : NodeTraversal::InclusiveAncestorsOf(*node)) {
if (IsA<HTMLAnchorElement>(runner) || if (IsA<HTMLAnchorElement>(runner))
(runner.GetLayoutObject() &&
cache.GetOrCreate(runner.GetLayoutObject())->IsAnchor()))
return To<Element>(&runner); return To<Element>(&runner);
if (LayoutObject* layout_object = runner.GetLayoutObject()) {
AXObject* ax_object = cache.GetOrCreate(layout_object);
if (ax_object && ax_object->IsAnchor())
return To<Element>(&runner);
}
} }
return nullptr; return nullptr;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment