Bug 1494707 - Add a null check for a retrieved row accessible in HTMLTableAccessible::CellAt, r=surkov
authorMarco Zehe <mzehe@mozilla.com>
Thu, 04 Oct 2018 06:30:06 +0000
changeset 495256 b5a47b972169a6fea58589a0513ddce7b289c7b9
parent 495255 c50a3b343ac847e4e112bbb8b4c2892167813b80
child 495257 ee830971f05015788d8087fb2beb2eb8ba8223bf
push id9984
push userffxbld-merge
push dateMon, 15 Oct 2018 21:07:35 +0000
treeherdermozilla-beta@183d27ea8570 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssurkov
bugs1494707, 1486668
milestone64.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1494707 - Add a null check for a retrieved row accessible in HTMLTableAccessible::CellAt, r=surkov When checking for an accessible if it is a table row instead of a table cell, when retrieving the actual row at the given index, null check it to make sure we don't pass an invalid accessible to the TableAccessible::CellInRowAt method. I accidentally omitted that null check in the updated patch for bug 1486668. Differential Revision: https://phabricator.services.mozilla.com/D7162
accessible/html/HTMLTableAccessible.cpp
accessible/tests/crashtests/1494707.html
accessible/tests/crashtests/crashtests.list
--- a/accessible/html/HTMLTableAccessible.cpp
+++ b/accessible/html/HTMLTableAccessible.cpp
@@ -618,18 +618,17 @@ HTMLTableAccessible::CellAt(uint32_t aRo
 
   nsIContent* cellContent = tableFrame->GetCellAt(aRowIdx, aColIdx);
   Accessible* cell = mDoc->GetAccessible(cellContent);
 
   // Sometimes, the accessible returned here is a row accessible instead of
   // a cell accessible, for example when a cell has CSS display:block; set.
   // In such cases, iterate through the cells in this row differently to find it.
   if (cell && cell->IsTableRow()) {
-    Accessible* row = RowAt(aRowIdx);
-    return CellInRowAt(row, aColIdx);
+    return CellInRowAt(cell, aColIdx);
   }
 
   // XXX bug 576838: crazy tables (like table6 in tables/test_table2.html) may
   // return itself as a cell what makes Orca hang.
   return cell == this ? nullptr : cell;
 }
 
 int32_t
new file mode 100644
--- /dev/null
+++ b/accessible/tests/crashtests/1494707.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+    <style>
+      *::after {
+        content: counters(bar, '', none);
+      }
+    </style>    
+  </head>
+  <body>
+    <table>
+      <thead></thead>
+      <th></th>
+    </table>
+  </body>
+</html>
--- a/accessible/tests/crashtests/crashtests.list
+++ b/accessible/tests/crashtests/crashtests.list
@@ -3,12 +3,13 @@ load 471493.xul
 asserts-if(!browserIsRemote,2) load 884202.html
 load 890760.html
 load 893515.html
 load 1072792.xhtml
 load 1380199.html
 load 1402999.html
 load 1463962.html
 load 1484778.html
+load 1494707.html
 
 # last_test_to_unload_testsuite.xul MUST be the last test in the list because it
 # is responsible for shutting down accessibility service affecting later tests.
 load last_test_to_unload_testsuite.xul