Crash in RenderMenuList::didUpdateActiveOption.
https://bugs.webkit.org/show_bug.cgi?id=208867
<rdar://problem/60035390>
Reviewed by Chris Fleizach.
Source/WebCore:
Enabled test accessibility/menu-list-sends-change-notification.html.
- Check the type of the AccessibilityObject before downcasting in RenderMenuList.
- Fixed handling of the AXMenuListValueChanged notification on the Mac.
This notification was previously ignored and hence the LayoutTest was failing.
* accessibility/mac/AXObjectCacheMac.mm:
(WebCore::AXObjectCache::postPlatformNotification):
* rendering/RenderMenuList.cpp:
(RenderMenuList::didUpdateActiveOption):
LayoutTests:
Enabled accessibility/menu-list-sends-change-notification.html test
and added the expected.txt file for it.
* accessibility/menu-list-sends-change-notification-expected.txt: Added.
* accessibility/menu-list-sends-change-notification.html:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@259438 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 8dfd457..55e936e 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2020-04-02 Andres Gonzalez <andresg_22@apple.com>
+
+ Crash in RenderMenuList::didUpdateActiveOption.
+ https://bugs.webkit.org/show_bug.cgi?id=208867
+ <rdar://problem/60035390>
+
+ Reviewed by Chris Fleizach.
+
+ Enabled accessibility/menu-list-sends-change-notification.html test
+ and added the expected.txt file for it.
+
+ * accessibility/menu-list-sends-change-notification-expected.txt: Added.
+ * accessibility/menu-list-sends-change-notification.html:
+
2020-04-02 Said Abou-Hallawa <sabouhallawa@apple.com>
[ iOS wk2 ] fast/images/exif-orientation-background-image-repeat.html is flaky failing.
diff --git a/LayoutTests/accessibility/menu-list-sends-change-notification-expected.txt b/LayoutTests/accessibility/menu-list-sends-change-notification-expected.txt
new file mode 100644
index 0000000..bc3d4c4
--- /dev/null
+++ b/LayoutTests/accessibility/menu-list-sends-change-notification-expected.txt
@@ -0,0 +1,12 @@
+
+This tests that changing the value of a menu list sends a notification even when it's not popped open.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Load event notification received.
+MenuList received notification: AXMenuItemSelected
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/menu-list-sends-change-notification.html b/LayoutTests/accessibility/menu-list-sends-change-notification.html
index bae903a..2274bce 100644
--- a/LayoutTests/accessibility/menu-list-sends-change-notification.html
+++ b/LayoutTests/accessibility/menu-list-sends-change-notification.html
@@ -1,6 +1,6 @@
<html>
<head>
-<script src="../resources/js-test.js"></script>
+<script src="../resources/js-test-pre.js"></script>
<script>
jsTestIsAsync = true;
@@ -12,7 +12,7 @@
var accessibleMenulist = accessibilityController.focusedElement;
function listener(notification) {
- document.getElementById("console").innerText += "Got notification: " + notification + "\n";
+ debug("MenuList received notification: " + notification);
accessibleMenulist.removeNotificationListener(listener);
finishJSTest();
}
@@ -20,15 +20,11 @@
// Change the selected index.
menulist.selectedIndex = 1;
-
- // Make the test finish quickly whether we get the notification or not.
- window.setTimeout(function() {
- finishJSTest();
- }, 10);
}
if (window.testRunner && window.accessibilityController) {
window.addEventListener('load', function() {
+ debug("Load event notification received.");
setTimeout(runTest, 10);
}, false);
}
@@ -45,5 +41,6 @@
<p id="description"></p>
<div id="console"></div>
+<script src="../resources/js-test-post.js"></script>
</body>
</html>
diff --git a/LayoutTests/platform/mac/TestExpectations b/LayoutTests/platform/mac/TestExpectations
index a8a3e87..bd4036c 100644
--- a/LayoutTests/platform/mac/TestExpectations
+++ b/LayoutTests/platform/mac/TestExpectations
@@ -67,7 +67,6 @@
accessibility/aria-switch-sends-notification.html
accessibility/combo-box-collapsed-selection-changed.html
accessibility/children-changed-sends-notification.html
-accessibility/menu-list-sends-change-notification.html
accessibility/multiselect-list-reports-active-option.html
# Need to implement AccessibilityUIElement::clearSelectedChildren()
@@ -1974,4 +1973,4 @@
webkit.org/b/209740 webgl/2.0.0/conformance2/rendering/framebuffer-completeness-unaffected.html [ Failure ]
-webkit.org/b/209908 svg/custom/animate-initial-pause-unpause.html [ Pass Timeout ]
\ No newline at end of file
+webkit.org/b/209908 svg/custom/animate-initial-pause-unpause.html [ Pass Timeout ]
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 61b3c9c..b15a53e 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2020-04-02 Andres Gonzalez <andresg_22@apple.com>
+
+ Crash in RenderMenuList::didUpdateActiveOption.
+ https://bugs.webkit.org/show_bug.cgi?id=208867
+ <rdar://problem/60035390>
+
+ Reviewed by Chris Fleizach.
+
+ Enabled test accessibility/menu-list-sends-change-notification.html.
+
+ - Check the type of the AccessibilityObject before downcasting in RenderMenuList.
+ - Fixed handling of the AXMenuListValueChanged notification on the Mac.
+ This notification was previously ignored and hence the LayoutTest was failing.
+
+ * accessibility/mac/AXObjectCacheMac.mm:
+ (WebCore::AXObjectCache::postPlatformNotification):
+ * rendering/RenderMenuList.cpp:
+ (RenderMenuList::didUpdateActiveOption):
+
2020-04-02 Eric Carlson <eric.carlson@apple.com>
Remove unused media controls code
diff --git a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
index 3bace93..688782c 100644
--- a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -341,6 +341,7 @@
macNotification = (id)kAXMenuClosedNotification;
break;
case AXMenuListItemSelected:
+ case AXMenuListValueChanged:
macNotification = (id)kAXMenuItemSelectedNotification;
break;
case AXPressDidSucceed:
diff --git a/Source/WebCore/rendering/RenderMenuList.cpp b/Source/WebCore/rendering/RenderMenuList.cpp
index 02f1cbf..8e09ea5 100644
--- a/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/Source/WebCore/rendering/RenderMenuList.cpp
@@ -420,8 +420,9 @@
if (listIndex < 0 || listIndex >= static_cast<int>(selectElement().listItems().size()))
return;
- if (auto* menuList = downcast<AccessibilityMenuList>(axCache->get(this)))
- menuList->didUpdateActiveOption(optionIndex);
+ auto* axObject = axCache->get(this);
+ if (is<AccessibilityMenuList>(axObject))
+ downcast<AccessibilityMenuList>(*axObject).didUpdateActiveOption(optionIndex);
}
String RenderMenuList::itemText(unsigned listIndex) const
