Skip to content

Commit 8bc3a0e

Browse files
whsiehwhsieh
committed
REGRESSION (298476@main): [AX] Crash under WebCore::Editor::respondToChangedContents when VoiceOver is enabled
https://bugs.webkit.org/show_bug.cgi?id=301982 rdar://163230929 Reviewed by Abrar Rahman Protyasha. Restore a null check for `node` in `Editor::respondToChangedContents` that was (effectively) removed in 298476@main. Prior to that patch, we only passed a pointer into `AXObjectCache::postNotification`, which would become a no-op if the `node` was null. After that change, we now (incorrectly) assume the `node` is non-null and dereference it. The selection start node might be null in the case where, while processing the editing command, we mutated the DOM in such a way that the selection anchor is no longer connected or editable. Test: accessibility/crash-when-deleting-hidden-element.html * LayoutTests/accessibility/crash-when-deleting-hidden-element-expected.txt: Added. * LayoutTests/accessibility/crash-when-deleting-hidden-element.html: Added. Add a layout test to exercise the fix by verifying that we don't crash when accessibility is enabled, under this codepath. * Source/WebCore/editing/Editor.cpp: (WebCore::Editor::respondToChangedContents): Canonical link: https://commits.webkit.org/302581@main
1 parent b64ace9 commit 8bc3a0e

File tree

3 files changed

+46
-3
lines changed

3 files changed

+46
-3
lines changed

‎LayoutTests/accessibility/crash-when-deleting-hidden-element-expected.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
successfullyParsed is true
2+
3+
TEST COMPLETE
4+
PASS

‎LayoutTests/accessibility/crash-when-deleting-hidden-element.html‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<script src="../resources/js-test.js"></script>
5+
<script>
6+
window.accessibilityController?.enableEnhancedAccessibility(true);
7+
8+
addEventListener("load", () => {
9+
document.execCommand("SelectAll");
10+
const span = document.getElementsByTagName("span")[0];
11+
span.contentEditable = true;
12+
span.textContent = "bar";
13+
document.execCommand("InsertText", false, "b");
14+
document.body.textContent = "PASS";
15+
});
16+
</script>
17+
18+
<style>
19+
* {
20+
visibility: visible;
21+
}
22+
23+
.inline {
24+
display: inline;
25+
}
26+
27+
* :only-child {
28+
visibility: hidden;
29+
}
30+
</style>
31+
</head>
32+
<body>
33+
<table>
34+
<tr><td><span><table></table><span></span></span></td></tr>
35+
<tr><td><td style="height: 100px;" class="inline">a</td></tr>
36+
</table>
37+
</body>
38+
</html>

‎Source/WebCore/editing/Editor.cpp‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -838,9 +838,10 @@ bool Editor::shouldInsertText(const String& text, const std::optional<SimpleRang
838838
void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
839839
{
840840
if (AXObjectCache::accessibilityEnabled()) {
841-
RefPtr node = endingSelection.start().deprecatedNode();
842-
if (AXObjectCache* cache = document().existingAXObjectCache())
843-
cache->onEditableTextValueChanged(*node.get());
841+
if (RefPtr node = endingSelection.start().deprecatedNode()) {
842+
if (AXObjectCache* cache = document().existingAXObjectCache())
843+
cache->onEditableTextValueChanged(*node.get());
844+
}
844845
}
845846

846847
updateMarkersForWordsAffectedByEditing(true);

0 commit comments

Comments
 (0)