Bug 1718990 [wpt PR 29568] - Address crash when changing aria-owned parents for a given node, a=testonly
☠☠ backed out by dec0a179f851 ☠ ☠
authorAaron Leventhal <aleventhal@google.com>
Sat, 17 Jul 2021 09:46:44 +0000
changeset 585795 66d418216d04caa948c56ec9155311a01f50150b
parent 585794 b4d7756e4c38a822ac6917c47e9838dcd6ca3862
child 585796 c0a26ed925f6610ca6ad1fde405ebc862f94c76a
push id38620
push usercsabou@mozilla.com
push dateSun, 18 Jul 2021 09:08:29 +0000
treeherdermozilla-central@cc4e5ea0c986 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstestonly
bugs1718990, 29568, 1225582, 3002626, 899228
milestone92.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1718990 [wpt PR 29568] - Address crash when changing aria-owned parents for a given node, a=testonly Automatic update from web-platform-tests Address crash when changing aria-owned parents for a given node When changing from one aria-owned parent to another, do not first RestoreParentOrPrune() as we normally would when *removing* aria-owns. That method usually restores the natural parent, but it can also remove the child when it's in a subtree that cannot have descendants, e.g. when AXNodeObject::CanHaveChildren() returns false. Bug: 1225582 Change-Id: I21d4e0ef2ed195a5a372c076df4357c781012c7b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3002626 Commit-Queue: Daniel Libby <dlibby@microsoft.com> Auto-Submit: Aaron Leventhal <aleventhal@chromium.org> Reviewed-by: Daniel Libby <dlibby@microsoft.com> Cr-Commit-Position: refs/heads/master@{#899228} -- wpt-commits: 8ee764101e28e3215a29808cb2c490f2be799416 wpt-pr: 29568
testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html
@@ -0,0 +1,13 @@
+<script>
+window.onload = function() {
+  // Reparent z1 under z2.
+  const z2 = document.getElementById('z2');
+  z2.appendChild(document.querySelector('#z1'));
+}
+</script>
+<div aria-owns="z1 z2">
+  <progress>
+    <div id="z1"></div>
+    <div id="z2"></div>
+  </progress>
+</div>