Skip to content

GitLab

T
tangled
Commit d352df25 authored by Dominic Mazzoni's avatar Dominic Mazzoni Committed by Commit Bot
Browse files
Options

Fix use-after-free in AXEventGenerator and add regression test. 

Bug: 778905
Change-Id: I45125eccc1a68f9f80d485dd32762258bd9466e1
Reviewed-on: https://chromium-review.googlesource.com/746144Reviewed-by: default avatarAaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512881}
parent cf3590fc
Hide whitespace changes
Inline Side-by-side
Showing with 30 additions and 0 deletions
content/browser/accessibility/dump_accessibility_tree_browsertest.cc
View file @ d352df25
......@@ -116,6 +116,13 @@ class DumpAccessibilityTreeTest : public DumpAccessibilityTestBase {
RunTest(html_file, "accessibility/html");
}
void RunRegressionTest(const base::FilePath::CharType* file_path) {
base::FilePath test_path = GetTestFilePath("accessibility", "regression");
base::FilePath test_file = test_path.Append(base::FilePath(file_path));
RunTest(test_file, "accessibility/regression");
}
std::vector<std::string> Dump() override {
std::unique_ptr<AccessibilityTreeFormatter> formatter(
CreateAccessibilityTreeFormatter());
......@@ -1689,4 +1696,14 @@ IN_PROC_BROWSER_TEST_F(DumpAccessibilityTreeTest,
RunHtmlTest(FILE_PATH_LITERAL("window-crops-items.html"));
}
//
// Regression tests. These don't test a specific web platform feature,
// they test a specific web page that crashed or had some bad behavior
// in the past.
//
IN_PROC_BROWSER_TEST_F(DumpAccessibilityTreeTest, XmlInIframeCrash) {
RunRegressionTest(FILE_PATH_LITERAL("xml-in-iframe-crash.html"));
}
} // namespace content
content/test/data/accessibility/regression/xml-in-iframe-crash.html 0 → 100644
View file @ d352df25
<script>
function shouldNotBeExecuted()
{
var divElement = document.createElement("div");
document.body.appendChild(divElement);
}
</script>
<body onLoad="shouldNotBeExecuted();">
<iframe src="foo.xml"/>
ui/accessibility/ax_event_generator.cc
View file @ d352df25
......@@ -281,6 +281,7 @@ void AXEventGenerator::OnSubtreeWillBeDeleted(AXTree* tree, AXNode* node) {
void AXEventGenerator::OnNodeWillBeReparented(AXTree* tree, AXNode* node) {
DCHECK_EQ(tree_, tree);
tree_events_.erase(node);
}
void AXEventGenerator::OnSubtreeWillBeReparented(AXTree* tree, AXNode* node) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment