Skip to content

GitLab

T
tangled
Commit c1a95080 authored by Adam Ettenberger's avatar Adam Ettenberger Committed by Commit Bot
Browse files
Options

Fix null-dereference in AXNodeObject::AnchorElement 

AXObjectCacheImpl::GetOrCreate(LayoutObject*) can return a nullptr
if the node is an area element.

This change makes sure that the AXObject is valid before
calling |IsAnchor|.

Bug: 996460
Change-Id: I63b966615aec010c6df03292addbcd0a71e405ae
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1772283Reviewed-by: default avatarKevin Babbitt <kbabbitt@microsoft.com>
Reviewed-by: default avatarAaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Adam Ettenberger <adettenb@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#691888}
parent 7269950b
Hide whitespace changes
Inline Side-by-side
Showing with 41 additions and 3 deletions
content/browser/accessibility/dump_accessibility_tree_browsertest.cc
View file @ c1a95080
...@@ -315,6 +315,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAreaCrash) { ...@@ -315,6 +315,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAreaCrash) {
RunHtmlTest(FILE_PATH_LITERAL("area-crash.html")); RunHtmlTest(FILE_PATH_LITERAL("area-crash.html"));
} }
IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
AccessibilityAreaSerializationCrash) {
RunHtmlTest(FILE_PATH_LITERAL("area-serialization-crash.html"));
}
IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAName) { IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAName) {
RunHtmlTest(FILE_PATH_LITERAL("a-name.html")); RunHtmlTest(FILE_PATH_LITERAL("a-name.html"));
} }
......
content/test/data/accessibility/html/area-serialization-crash-expected-blink.txt 0 → 100644
View file @ c1a95080
rootWebArea
++genericContainer
++++link
++++++genericContainer invisible
++++staticText name='done'
++++++inlineTextBox name='done'
content/test/data/accessibility/html/area-serialization-crash.html 0 → 100644
View file @ c1a95080
<!--
@WAIT-FOR:done
This is a regression test for a bug that crashes during blink serialization
when determining if an area element is a descendant of an anchor.
-->
<!DOCTYPE html>
<html>
<script>
window.onload = () => {
var canvas = document.createElement('canvas');
canvas.id = 'canvas';
canvas.hidden = true;
var area = document.createElement('area');
area.appendChild(canvas);
document.body.appendChild(area);
document.body.appendChild(document.createTextNode('done'));
};
</script>
<body>
</body>
</html>
third_party/blink/renderer/modules/accessibility/ax_node_object.cc
View file @ c1a95080
...@@ -2575,10 +2575,14 @@ Element* AXNodeObject::AnchorElement() const { ...@@ -2575,10 +2575,14 @@ Element* AXNodeObject::AnchorElement() const {
// NOTE: this assumes that any non-image with an anchor is an // NOTE: this assumes that any non-image with an anchor is an
// HTMLAnchorElement // HTMLAnchorElement
for (; node; node = node->parentNode()) { for (; node; node = node->parentNode()) {
if (IsA<HTMLAnchorElement>(*node) || if (IsA<HTMLAnchorElement>(*node))
(node->GetLayoutObject() &&
cache.GetOrCreate(node->GetLayoutObject())->IsAnchor()))
return To<Element>(node); return To<Element>(node);
if (LayoutObject* layout_object = node->GetLayoutObject()) {
AXObject* ax_object = cache.GetOrCreate(layout_object);
if (ax_object && ax_object->IsAnchor())
return To<Element>(node);
}
} }
return nullptr; return nullptr;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment