nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/accessibility/crash-adopt-node-from-new-d...

3 lines
126 B
Plaintext
Raw Permalink Normal View History

Use-after-free in AXObjectCache::notificationPostTimerFired https://bugs.webkit.org/show_bug.cgi?id=106106 Reviewed by Ryosuke Niwa. Source/WebCore: Fixes a crash that occurs when a Node is adopted by another document, in particular one that isn't part of the page, and then deleted, which wasn't triggering the code that removed the Node from AXObjectCache. Now, a Node is removed from the AXObjectCache whenever its Document changes. Test: accessibility/crash-adopt-node-from-new-document.html * dom/Node.cpp: (WebCore::Node::didMoveToNewDocument): LayoutTests: Test that demonstrates the crash when a Node with an AccessibilityObject changes its document and then isn't removed from the AXObjectCache when it's deleted. * accessibility/crash-adopt-node-from-new-document-expected.txt: Added. * accessibility/crash-adopt-node-from-new-document.html: Added. Canonical link: https://commits.webkit.org/125189@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@139806 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-01-16 00:13:15 +00:00
ALERT: This test makes sure that adopting a node with an AccessibilityObject into a new document doesn't crash. Test passed.