64256 2011-07-11 02:14:59 -0700 REGRESSION(r90552): platform/mac/accessibility/html-slider-indicator.html fails 2011-07-11 05:29:54 -0700 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 0 shinyak webkit-unassigned tkent webkit.review.bot oldest_to_newest 434718 0 shinyak 2011-07-11 02:14:59 -0700 Accessibility component in range input does not work after this patch: https://bugs.webkit.org/show_bug.cgi?id=52262 434721 1 100256 shinyak 2011-07-11 02:26:25 -0700 Created attachment 100256 Patch 434725 2 100256 tkent 2011-07-11 02:33:28 -0700 Comment on attachment 100256 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=100256&action=review > Source/WebCore/html/RangeInputType.cpp:224 > element()->dispatchFormControlChangeEvent(); > + > + if (AXObjectCache::accessibilityEnabled()) > + element()->document()->axObjectCache()->postNotification(element()->renderer(), AXObjectCache::AXValueChanged, true); > } dispatchFormControlChangeEvent() dispatch an 'change' event, so a JavaScript code runs in it. The JavaScriptCode can delete the parent <input>, and can change the type of the <input>. So accessing element() after dispatchFormControlChangeEvent() causes a use-after-free. You need to protect a reference of element() by RefPtr<> in order to keep <input> alive and in order to avoid 'this' access. RefPtr<HTMLInputELement> input = element(); input->dispatchFormControlChangeEvent(); if (...) input->document()->axObjectCache()->postNotification(input->renderer(), ... 434738 3 100256 shinyak 2011-07-11 03:45:09 -0700 Comment on attachment 100256 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=100256&action=review >> Source/WebCore/html/RangeInputType.cpp:224 >> } > > dispatchFormControlChangeEvent() dispatch an 'change' event, so a JavaScript code runs in it. > The JavaScriptCode can delete the parent <input>, and can change the type of the <input>. So accessing element() after dispatchFormControlChangeEvent() causes a use-after-free. > > You need to protect a reference of element() by RefPtr<> in order to keep <input> alive and in order to avoid 'this' access. > RefPtr<HTMLInputELement> input = element(); > input->dispatchFormControlChangeEvent(); > if (...) > input->document()->axObjectCache()->postNotification(input->renderer(), ... I found that postNotification() is called before dispatchFormControlChangeEvent() in HTMLInputElement::setChecked(). So If it is OK, I would like to move postNotification before dispatchFormControlChangeEvent. Do you think it may also break something? If so, I will use RefPtr to keep it. 434742 4 100256 tkent 2011-07-11 04:00:09 -0700 Comment on attachment 100256 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=100256&action=review >>> Source/WebCore/html/RangeInputType.cpp:224 >>> } >> >> dispatchFormControlChangeEvent() dispatch an 'change' event, so a JavaScript code runs in it. >> The JavaScriptCode can delete the parent <input>, and can change the type of the <input>. So accessing element() after dispatchFormControlChangeEvent() causes a use-after-free. >> >> You need to protect a reference of element() by RefPtr<> in order to keep <input> alive and in order to avoid 'this' access. >> RefPtr<HTMLInputELement> input = element(); >> input->dispatchFormControlChangeEvent(); >> if (...) >> input->document()->axObjectCache()->postNotification(input->renderer(), ... > > I found that postNotification() is called before dispatchFormControlChangeEvent() in HTMLInputElement::setChecked(). > So If it is OK, I would like to move postNotification before dispatchFormControlChangeEvent. Do you think it may also break something? If so, I will use RefPtr to keep it. It's ok to move because the code without r90552 dispatched AXValueChanged then 'change'. But I'm not confident AXValueChanged notification won't delete the element. 434757 5 100266 shinyak 2011-07-11 04:38:58 -0700 Created attachment 100266 Patch 434759 6 100266 tkent 2011-07-11 04:41:52 -0700 Comment on attachment 100266 Patch ok 434795 7 webkit.review.bot 2011-07-11 05:28:19 -0700 The commit-queue encountered the following flaky tests while processing attachment 100266: http/tests/misc/slow-loading-mask.html bug 64069 (author: bdakin@apple.com) fast/blockflow/japanese-lr-selection.html bug 64264 (author: hyatt@apple.com) fast/blockflow/japanese-rl-selection.html bug 64265 (author: hyatt@apple.com) fast/box-shadow/scaled-box-shadow.html bug 64266 (author: simon.fraser@apple.com) fast/backgrounds/background-leakage.html bug 64267 (author: simon.fraser@apple.com) fast/backgrounds/repeat/negative-offset-repeat.html bug 64268 (author: mitz@webkit.org) fast/filesystem/filesystem-uri-origin.html bug 63206 (author: adamk@chromium.org) transforms/2d/hindi-rotated.html bug 64269 (authors: darin@apple.com and jshin@chromium.org) svg/repaint/filter-repaint.svg bug 64270 (author: krit@webkit.org) svg/W3C-SVG-1.1/struct-use-01-t.svg bug 64271 (authors: darin@apple.com and eric@webkit.org) svg/transforms/text-with-mask-with-svg-transform.svg bug 64272 (author: zimmermann@kde.org) The commit-queue is continuing to process your patch. 434798 8 100266 webkit.review.bot 2011-07-11 05:29:50 -0700 Comment on attachment 100266 Patch Clearing flags on attachment: 100266 Committed r90737: <http://trac.webkit.org/changeset/90737> 434799 9 webkit.review.bot 2011-07-11 05:29:54 -0700 All reviewed patches have been landed. Closing bug. 100256 2011-07-11 02:26:25 -0700 2011-07-11 04:38:50 -0700 Patch bug-64256-20110711182623.patch text/plain 1808 shinyak U3VidmVyc2lvbiBSZXZpc2lvbjogOTA3MjEKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCBmZWQxNTEzNzZiOTMyZDQ5 MmJmMjI3ODkzYzM0ZGE4Y2ZjYjY5ZWQ1Li41YWFiZWQ4MmYyOWFiNzEzNTAzYTg3NDA3Zjc1ODhm OTdmYjdhZGQ4IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMTEtMDctMTEgIFNoaW55 YSBLYXdhbmFrYSAgPHNoaW55YWtAZ29vZ2xlLmNvbT4KKworICAgICAgICBBZGRlZCBhY2Nlc3Np YmlsaXR5IG5vdGlmaWNhdGlvbiB3aGVuIHZhbHVlIGlzIGNoYW5nZWQuCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02NDI1NgorCisgICAgICAgIE5vdGlm aWVzIHRoZSB2YWx1ZSBjaGFuZ2Ugb2YgcmFuZ2UgaW5wdXQgd2hlbiBhY2Nlc3NpYmlsaXR5IGlz IGVuYWJsZWQuCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgQ292ZXJlZCBieSBleGlzdGluZyB0ZXN0cy4KKworICAgICAgICAqIGh0bWwvUmFuZ2VJbnB1 dFR5cGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmFuZ2VJbnB1dFR5cGU6OmhhbmRsZUtleWRv d25FdmVudCk6CisgICAgICAgICAgQWRkZWQgYWNjZXNzaWJpbGl0eSBub3RpZmljYXRpb24gd2hl biB2YWx1ZSBpcyBjaGFuZ2VkLgorCiAyMDExLTA3LTA4ICBNaWtoYWlsIE5hZ2Fub3YgIDxtbmFn YW5vdkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgV2ViIEluc3BlY3RvcjogW0Nocm9taXVtXSBH ZXQgcmlkIG9mIGZsaWNrZXJpbmcgIlBsZWFzZSB3YWl0IiBtZXNzYWdlIGluIEhlYXAgcHJvZmls ZXIuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9odG1sL1JhbmdlSW5wdXRUeXBlLmNwcCBi L1NvdXJjZS9XZWJDb3JlL2h0bWwvUmFuZ2VJbnB1dFR5cGUuY3BwCmluZGV4IGRlODllNGU2NWMy MWY1YzE3MTBhOWMxN2E2ODliNWU2OGJjZDBkMWYuLmFlNjY2MmM4YmJhNTQyOGZjZTNjZjczY2I4 MzY3Y2ZjM2EzNmI0YTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvUmFuZ2VJbnB1 dFR5cGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvUmFuZ2VJbnB1dFR5cGUuY3BwCkBA IC0zMiw2ICszMiw3IEBACiAjaW5jbHVkZSAiY29uZmlnLmgiCiAjaW5jbHVkZSAiUmFuZ2VJbnB1 dFR5cGUuaCIKIAorI2luY2x1ZGUgIkFYT2JqZWN0Q2FjaGUuaCIKICNpbmNsdWRlICJIVE1MRGl2 RWxlbWVudC5oIgogI2luY2x1ZGUgIkhUTUxJbnB1dEVsZW1lbnQuaCIKICNpbmNsdWRlICJIVE1M TmFtZXMuaCIKQEAgLTIxNyw2ICsyMTgsOSBAQCB2b2lkIFJhbmdlSW5wdXRUeXBlOjpoYW5kbGVL ZXlkb3duRXZlbnQoS2V5Ym9hcmRFdmVudCogZXZlbnQpCiAgICAgICAgIEV4Y2VwdGlvbkNvZGUg ZWM7CiAgICAgICAgIHNldFZhbHVlQXNOdW1iZXIobmV3VmFsdWUsIGVjKTsKICAgICAgICAgZWxl bWVudCgpLT5kaXNwYXRjaEZvcm1Db250cm9sQ2hhbmdlRXZlbnQoKTsKKworICAgICAgICBpZiAo QVhPYmplY3RDYWNoZTo6YWNjZXNzaWJpbGl0eUVuYWJsZWQoKSkKKyAgICAgICAgICAgIGVsZW1l bnQoKS0+ZG9jdW1lbnQoKS0+YXhPYmplY3RDYWNoZSgpLT5wb3N0Tm90aWZpY2F0aW9uKGVsZW1l bnQoKS0+cmVuZGVyZXIoKSwgQVhPYmplY3RDYWNoZTo6QVhWYWx1ZUNoYW5nZWQsIHRydWUpOwog ICAgIH0KIAogICAgIGV2ZW50LT5zZXREZWZhdWx0SGFuZGxlZCgpOwo= 100266 2011-07-11 04:38:58 -0700 2011-07-11 05:29:50 -0700 Patch bug-64256-20110711203856.patch text/plain 1807 shinyak U3VidmVyc2lvbiBSZXZpc2lvbjogOTA3MjEKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCBmZWQxNTEzNzZiOTMyZDQ5 MmJmMjI3ODkzYzM0ZGE4Y2ZjYjY5ZWQ1Li41YWFiZWQ4MmYyOWFiNzEzNTAzYTg3NDA3Zjc1ODhm OTdmYjdhZGQ4IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMTEtMDctMTEgIFNoaW55 YSBLYXdhbmFrYSAgPHNoaW55YWtAZ29vZ2xlLmNvbT4KKworICAgICAgICBBZGRlZCBhY2Nlc3Np YmlsaXR5IG5vdGlmaWNhdGlvbiB3aGVuIHZhbHVlIGlzIGNoYW5nZWQuCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02NDI1NgorCisgICAgICAgIE5vdGlm aWVzIHRoZSB2YWx1ZSBjaGFuZ2Ugb2YgcmFuZ2UgaW5wdXQgd2hlbiBhY2Nlc3NpYmlsaXR5IGlz IGVuYWJsZWQuCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgQ292ZXJlZCBieSBleGlzdGluZyB0ZXN0cy4KKworICAgICAgICAqIGh0bWwvUmFuZ2VJbnB1 dFR5cGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmFuZ2VJbnB1dFR5cGU6OmhhbmRsZUtleWRv d25FdmVudCk6CisgICAgICAgICAgQWRkZWQgYWNjZXNzaWJpbGl0eSBub3RpZmljYXRpb24gd2hl biB2YWx1ZSBpcyBjaGFuZ2VkLgorCiAyMDExLTA3LTA4ICBNaWtoYWlsIE5hZ2Fub3YgIDxtbmFn YW5vdkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgV2ViIEluc3BlY3RvcjogW0Nocm9taXVtXSBH ZXQgcmlkIG9mIGZsaWNrZXJpbmcgIlBsZWFzZSB3YWl0IiBtZXNzYWdlIGluIEhlYXAgcHJvZmls ZXIuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9odG1sL1JhbmdlSW5wdXRUeXBlLmNwcCBi L1NvdXJjZS9XZWJDb3JlL2h0bWwvUmFuZ2VJbnB1dFR5cGUuY3BwCmluZGV4IGRlODllNGU2NWMy MWY1YzE3MTBhOWMxN2E2ODliNWU2OGJjZDBkMWYuLmZiOWVlNWRlYmY0YzAyZDIwNWUzYjgyNjE2 MjM4MTVlMmQwZDg3OTQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvUmFuZ2VJbnB1 dFR5cGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvUmFuZ2VJbnB1dFR5cGUuY3BwCkBA IC0zMiw2ICszMiw3IEBACiAjaW5jbHVkZSAiY29uZmlnLmgiCiAjaW5jbHVkZSAiUmFuZ2VJbnB1 dFR5cGUuaCIKIAorI2luY2x1ZGUgIkFYT2JqZWN0Q2FjaGUuaCIKICNpbmNsdWRlICJIVE1MRGl2 RWxlbWVudC5oIgogI2luY2x1ZGUgIkhUTUxJbnB1dEVsZW1lbnQuaCIKICNpbmNsdWRlICJIVE1M TmFtZXMuaCIKQEAgLTIxNiw2ICsyMTcsOSBAQCB2b2lkIFJhbmdlSW5wdXRUeXBlOjpoYW5kbGVL ZXlkb3duRXZlbnQoS2V5Ym9hcmRFdmVudCogZXZlbnQpCiAgICAgaWYgKG5ld1ZhbHVlICE9IGN1 cnJlbnQpIHsKICAgICAgICAgRXhjZXB0aW9uQ29kZSBlYzsKICAgICAgICAgc2V0VmFsdWVBc051 bWJlcihuZXdWYWx1ZSwgZWMpOworCisgICAgICAgIGlmIChBWE9iamVjdENhY2hlOjphY2Nlc3Np YmlsaXR5RW5hYmxlZCgpKQorICAgICAgICAgICAgZWxlbWVudCgpLT5kb2N1bWVudCgpLT5heE9i amVjdENhY2hlKCktPnBvc3ROb3RpZmljYXRpb24oZWxlbWVudCgpLT5yZW5kZXJlcigpLCBBWE9i amVjdENhY2hlOjpBWFZhbHVlQ2hhbmdlZCwgdHJ1ZSk7CiAgICAgICAgIGVsZW1lbnQoKS0+ZGlz cGF0Y2hGb3JtQ29udHJvbENoYW5nZUV2ZW50KCk7CiAgICAgfQogCg==