wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 376924. Traversing the accessible tree after changes to CSS display property can crash Firefox. r=mats.palmgren

Browse Source
This commit is contained in:
aaronleventhal@moonset.net 2007-04-12 08:04:24 -07:00
parent 9c5fd9beb7
commit 0130acd0af
4 changed files with 3 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
accessible/src/html/nsHTMLLinkAccessible.cpp
View File

@ -44,7 +44,7 @@
NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLLinkAccessible, nsLinkableAccessible)
nsHTMLLinkAccessible::nsHTMLLinkAccessible(nsIDOMNode* aDomNode, nsIWeakReference* aShell, nsIFrame *aFrame):
nsLinkableAccessible(aDomNode, aShell), mFrame(aFrame)
nsLinkableAccessible(aDomNode, aShell)
{
}
@ -84,24 +84,3 @@ nsHTMLLinkAccessible::GetState(PRUint32 *aState, PRUint32 *aExtraState)
return NS_OK;
}
nsIFrame* nsHTMLLinkAccessible::GetFrame()
{
if (mWeakShell) {
if (!mFrame) {
mFrame = nsLinkableAccessible::GetFrame();
}
return mFrame;
}
return nsnull;
}
NS_IMETHODIMP nsHTMLLinkAccessible::FireToolkitEvent(PRUint32 aEvent,
nsIAccessible *aTarget,
void *aData)
{
if (aEvent == nsIAccessibleEvent::EVENT_HIDE) {
mFrame = nsnull; // Invalidate cached frame
}
return nsLinkableAccessible::FireToolkitEvent(aEvent, aTarget, aData);
}

11
accessible/src/html/nsHTMLLinkAccessible.h
View File

@ -52,17 +52,6 @@ public:
NS_IMETHOD GetName(nsAString& _retval);
NS_IMETHOD GetRole(PRUint32 *_retval);
NS_IMETHOD GetState(PRUint32 *aState, PRUint32 *aExtraState);
NS_IMETHOD Shutdown() { mFrame = nsnull; return nsLinkableAccessible::Shutdown(); }
// nsPIAccessNode
NS_IMETHOD_(nsIFrame *) GetFrame(void);
// nsPIAccessible
NS_IMETHOD FireToolkitEvent(PRUint32 aEvent, nsIAccessible *aTarget,
void *aData);
private:
nsIFrame *mFrame; // XXX What's special about links that we cache frames for them?
};
#endif

48
accessible/src/html/nsHTMLTextAccessible.cpp
View File

@ -50,7 +50,7 @@
#include "nsComponentManagerUtils.h"
nsHTMLTextAccessible::nsHTMLTextAccessible(nsIDOMNode* aDomNode, nsIWeakReference* aShell, nsIFrame *aFrame):
nsTextAccessibleWrap(aDomNode, aShell), mFrame(aFrame)
nsTextAccessibleWrap(aDomNode, aShell)
{
}
@ -77,27 +77,6 @@ NS_IMETHODIMP nsHTMLTextAccessible::GetName(nsAString& aName)
return rv;
}
nsIFrame* nsHTMLTextAccessible::GetFrame()
{
if (!mWeakShell) {
return nsnull;
}
if (!mFrame) {
mFrame = nsTextAccessible::GetFrame();
}
return mFrame;
}
NS_IMETHODIMP nsHTMLTextAccessible::FireToolkitEvent(PRUint32 aEvent,
nsIAccessible *aTarget,
void *aData)
{
if (aEvent == nsIAccessibleEvent::EVENT_HIDE) {
mFrame = nsnull; // Invalidate cached frame
}
return nsTextAccessibleWrap::FireToolkitEvent(aEvent, aTarget, aData);
}
NS_IMETHODIMP nsHTMLTextAccessible::GetRole(PRUint32 *aRole)
{
nsIFrame *frame = GetFrame();
@ -315,7 +294,7 @@ void nsHTMLLIAccessible::CacheChildren()
nsHTMLListBulletAccessible::
nsHTMLListBulletAccessible(nsIDOMNode* aDomNode, nsIWeakReference* aShell,
nsIFrame *aFrame, const nsAString& aBulletText) :
nsLeafAccessible(aDomNode, aShell), mFrame(aFrame), mWeakParent(nsnull),
nsLeafAccessible(aDomNode, aShell), mWeakParent(nsnull),
mBulletText(aBulletText)
{
mBulletText += ' '; // Otherwise bullets are jammed up against list text
@ -334,22 +313,10 @@ nsHTMLListBulletAccessible::Shutdown()
{
mBulletText.Truncate();
mWeakParent = nsnull;
mFrame = nsnull;
return nsLeafAccessible::Shutdown();
}
nsIFrame*
nsHTMLListBulletAccessible::GetFrame()
{
if (!mWeakShell)
return nsnull;
if (!mFrame)
mFrame = nsLeafAccessible::GetFrame();
return mFrame;
}
NS_IMETHODIMP
nsHTMLListBulletAccessible::GetName(nsAString &aName)
{
@ -390,16 +357,6 @@ nsHTMLListBulletAccessible::GetParent(nsIAccessible **aParentAccessible)
return NS_OK;
}
NS_IMETHODIMP
nsHTMLListBulletAccessible::FireToolkitEvent(PRUint32 aEvent,
nsIAccessible *aTarget,
void *aData)
{
if (aEvent == nsIAccessibleEvent::EVENT_HIDE)
mFrame = nsnull; // Invalidate cached frame
return nsLeafAccessible::FireToolkitEvent(aEvent, aTarget, aData);
}
NS_IMETHODIMP
nsHTMLListBulletAccessible::GetContentText(nsAString& aText)
{
@ -407,7 +364,6 @@ nsHTMLListBulletAccessible::GetContentText(nsAString& aText)
return NS_OK;
}
// nsHTMLListAccessible
NS_IMETHODIMP

18
accessible/src/html/nsHTMLTextAccessible.h
View File

@ -55,20 +55,6 @@ public:
NS_IMETHOD GetState(PRUint32 *aState, PRUint32 *aExtraState);
NS_IMETHOD GetRole(PRUint32 *aRole);
virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
NS_IMETHOD Shutdown() { mFrame = nsnull; return nsTextAccessibleWrap::Shutdown(); }
// nsPIAccessNode
NS_IMETHOD_(nsIFrame *) GetFrame(void);
// nsPIAccessible
NS_IMETHOD FireToolkitEvent(PRUint32 aEvent, nsIAccessible *aTarget,
void *aData);
private:
// We cache frames for text accessibles so that the primary frame map isn't
// increased in size just due to accessibility. Normally the primary frame map,
// which is used by nsIPresShell::GetPrimaryFrameFor(), does not include text frames
nsIFrame *mFrame; // Only valid if node is not shut down (mWeakShell != null)
};
class nsHTMLHRAccessible : public nsLeafAccessible
@ -111,7 +97,6 @@ public:
// nsPIAccessNode
NS_IMETHOD Shutdown();
NS_IMETHOD_(nsIFrame *) GetFrame(void);
// nsIAccessible
NS_IMETHOD GetName(nsAString& aName);
@ -125,8 +110,6 @@ public:
NS_IMETHOD GetParent(nsIAccessible **aParentAccessible);
// nsPIAccessible
NS_IMETHOD FireToolkitEvent(PRUint32 aEvent, nsIAccessible *aTarget,
void *aData);
NS_IMETHOD GetContentText(nsAString& aText);
protected:
@ -137,7 +120,6 @@ protected:
// here should not be a problem if we invalidate the right parts of
// the accessibility cache when mutation events occur.
nsIAccessible *mWeakParent;
nsIFrame *mFrame;
nsString mBulletText;
};