https://bugs.webkit.org/show_bug.cgi?id=106903
Reviewed by Martin Robinson.
Source/WebCore:
Add missing extra ref to implementation of atk_table_ref_at().
Test: accessibility/table-cell-for-column-and-row-crash.html
* accessibility/atk/WebKitAccessibleInterfaceTable.cpp:
(webkitAccessibleTableRefAt): This method transfers full ownership
over the returned AtkObject, so an extra reference is needed here.
Tools:
Both DRT and WKTR need to call g_object_unref() now that an extra
reference is added in the implementation of atk_table_ref_at().
* DumpRenderTree/atk/AccessibilityUIElementGtk.cpp:
(AccessibilityUIElement::cellForColumnAndRow): Call g_object_unref
before returning the new instance of AccessibilityUIElement.
* WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:
(WTR::AccessibilityUIElement::cellForColumnAndRow): Ditto.
LayoutTests:
Added new test. It should work fine at least in Mac and GTK ports,
but will need specific results for chromium and windows.
* accessibility/table-cell-for-column-and-row-crash.html: Added.
* accessibility/table-cell-for-column-and-row-crash-expected.txt: Added.
* platform/chromium/TestExpectations: Skipped test.
* platform/win/TestExpectations: Ditto.
* platform/wincairo/TestExpectations: Ditto.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@142883
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2013-02-14 Mario Sanchez Prada <mario.prada@samsung.com>
+
+ [GTK] Missing call to g_object_ref while retrieving accessible table cells
+ https://bugs.webkit.org/show_bug.cgi?id=106903
+
+ Reviewed by Martin Robinson.
+
+ Added new test. It should work fine at least in Mac and GTK ports,
+ but will need specific results for chromium and windows.
+
+ * accessibility/table-cell-for-column-and-row-crash.html: Added.
+ * accessibility/table-cell-for-column-and-row-crash-expected.txt: Added.
+ * platform/chromium/TestExpectations: Skipped test.
+ * platform/win/TestExpectations: Ditto.
+ * platform/wincairo/TestExpectations: Ditto.
+
2013-02-14 Ádám Kallai <kadam@inf.u-szeged.hu>
[Qt] Reviewing TestExpectations. Added platform specific expected files and unskip them.
--- /dev/null
+foo
+bar
+This tests that retrieving a cell for a table multiple times doesn't crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS axTable.role is 'AXRole: AXTable'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS axCell.role is 'AXRole: AXCell'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
--- /dev/null
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+
+<body id="body">
+<table id="testTable" summary="A summary to make sure this is always exposed as an AXTable">
+ <tr><td>foo</td></tr>
+ <tr><td>bar</td></tr>
+</table>
+
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This tests that retrieving a cell for a table multiple times doesn't crash.");
+
+if (window.testRunner) {
+ testRunner.dumpAsText();
+
+ if (window.accessibilityController) {
+ document.getElementById("body").focus();
+ var axBody = accessibilityController.focusedElement;
+
+ var axTable = axBody.childAtIndex(0);
+ shouldBe("axTable.role", "'AXRole: AXTable'");
+
+ // Trying to reference the same cell for the table
+ // multiple times shouldn't result in a crash.
+ for (var i = 0; i < 10; i++) {
+ var axCell = axTable.cellForColumnAndRow(0, 0);
+ shouldBe("axCell.role", "'AXRole: AXCell'");
+ axCell = null;
+
+ // We need to force a call to the Garbage Collector here so we are
+ // sure that axCell will get actually destroyed after using it.
+ gc();
+ }
+ }
+}
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
crbug.com/10322 accessibility/plugin.html [ Skip ]
crbug.com/10322 accessibility/radio-button-group-members.html [ Skip ]
crbug.com/10322 accessibility/table-attributes.html [ Skip ]
+crbug.com/10322 accessibility/table-cell-for-column-and-row-crash.html [ Skip ]
crbug.com/10322 accessibility/table-cell-spans.html [ Skip ]
crbug.com/10322 accessibility/table-cells.html [ Skip ]
crbug.com/10322 accessibility/table-one-cell.html [ Skip ]
accessibility/spinbutton-value.html
accessibility/svg-remote-element.html
accessibility/table-attributes.html
+accessibility/table-cell-for-column-and-row-crash.html
accessibility/table-cell-spans.html
accessibility/table-cells.html
accessibility/table-detection.html
accessibility/svg-remote-element.html
accessibility/table-attributes.html
accessibility/table-cell-spans.html
+accessibility/table-cell-for-column-and-row-crash.html
accessibility/table-cells.html
accessibility/table-detection.html
accessibility/table-modification-crash.html
+2013-02-14 Mario Sanchez Prada <mario.prada@samsung.com>
+
+ [GTK] Missing call to g_object_ref while retrieving accessible table cells
+ https://bugs.webkit.org/show_bug.cgi?id=106903
+
+ Reviewed by Martin Robinson.
+
+ Add missing extra ref to implementation of atk_table_ref_at().
+
+ Test: accessibility/table-cell-for-column-and-row-crash.html
+
+ * accessibility/atk/WebKitAccessibleInterfaceTable.cpp:
+ (webkitAccessibleTableRefAt): This method transfers full ownership
+ over the returned AtkObject, so an extra reference is needed here.
+
2013-02-14 Mike Fenton <mifenton@rim.com>
[BlackBerry] Update keyboard event details to match platform details.
AccessibilityTableCell* axCell = cell(table, row, column);
if (!axCell)
return 0;
- return axCell->wrapper();
+
+ AtkObject* cell = axCell->wrapper();
+ if (!cell)
+ return 0;
+
+ // This method transfers full ownership over the returned
+ // AtkObject, so an extra reference is needed here.
+ return ATK_OBJECT(g_object_ref(cell));
}
static gint webkitAccessibleTableGetIndexAt(AtkTable* table, gint row, gint column)
+2013-02-14 Mario Sanchez Prada <mario.prada@samsung.com>
+
+ [GTK] Missing call to g_object_ref while retrieving accessible table cells
+ https://bugs.webkit.org/show_bug.cgi?id=106903
+
+ Reviewed by Martin Robinson.
+
+ Both DRT and WKTR need to call g_object_unref() now that an extra
+ reference is added in the implementation of atk_table_ref_at().
+
+ * DumpRenderTree/atk/AccessibilityUIElementGtk.cpp:
+ (AccessibilityUIElement::cellForColumnAndRow): Call g_object_unref
+ before returning the new instance of AccessibilityUIElement.
+ * WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:
+ (WTR::AccessibilityUIElement::cellForColumnAndRow): Ditto.
+
2013-02-14 Sheriff Bot <webkit.review.bot@gmail.com>
Unreviewed, rolling out r142841.
ASSERT(ATK_IS_TABLE(m_element));
- AtkObject* foundCell = atk_table_ref_at(ATK_TABLE(m_element), row, column);
- return foundCell ? AccessibilityUIElement(foundCell) : 0;
+ // Adopt the AtkObject representing the cell because
+ // at_table_ref_at() transfers full ownership.
+ GRefPtr<AtkObject> foundCell = adoptGRef(atk_table_ref_at(ATK_TABLE(m_element), row, column));
+ return foundCell ? AccessibilityUIElement(foundCell.get()) : 0;
}
JSStringRef AccessibilityUIElement::selectedTextRange()
if (!m_element || !ATK_IS_TABLE(m_element))
return 0;
- AtkObject* foundCell = atk_table_ref_at(ATK_TABLE(m_element), row, col);
- return foundCell ? AccessibilityUIElement::create(foundCell) : 0;
+ // Adopt the AtkObject representing the cell because
+ // at_table_ref_at() transfers full ownership.
+ GRefPtr<AtkObject> foundCell = adoptGRef(atk_table_ref_at(ATK_TABLE(m_element), row, col));
+ return foundCell ? AccessibilityUIElement::create(foundCell.get()) : 0;
}
PassRefPtr<AccessibilityUIElement> AccessibilityUIElement::horizontalScrollbar() const
git://git.webkit.org / WebKit-https.git / commitdiff