AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24
authorn_wang@apple.com <n_wang@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 9 Aug 2017 17:52:36 +0000 (17:52 +0000)
committern_wang@apple.com <n_wang@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 9 Aug 2017 17:52:36 +0000 (17:52 +0000)
commit487cd627fe9c3e51fec1215a122943820359ca7d
treee3505fcd8a72b6bfd6dcb2714f12fda10ccc4825
parent03f4f4f1f54510dbcc5d33a79a60a6c65b0e5746
AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24
https://bugs.webkit.org/show_bug.cgi?id=175340
<rdar://problem/33782159>

Reviewed by Chris Fleizach.

Source/WebCore:

When adding a psuedo element child to a RenderBlockFlow element, there might be a chance where
the element has already been layed out but we are still holding onto its stale children. Fixed it
by notifying AX correctly when inserting/removing children during layout.

Test: accessibility/add-children-pseudo-element.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::insertFloatingObject):
(WebCore::RenderBlockFlow::removeFloatingObject):

LayoutTests:

* accessibility/add-children-pseudo-element-expected.txt: Added.
* accessibility/add-children-pseudo-element.html: Added.
* accessibility/resources/svg-circle.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@220463 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/accessibility/add-children-pseudo-element-expected.txt [new file with mode: 0644]
LayoutTests/accessibility/add-children-pseudo-element.html [new file with mode: 0644]
LayoutTests/accessibility/resources/svg-circle.svg [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlockFlow.cpp