Bug 629114 - crash on add comment link in review board [@ nsBulletFrame::GetListItemText ] [@ nsBulletFrame::GetListItemText(nsStyleList const&, nsString&) ], r=davidb, marcoz, sr=bz, a=blocking2.x+

This commit is contained in:
Alexander Surkov 2011-03-28 22:59:54 +09:00
parent 0f5f6be48e
commit 8eec39795c
13 changed files with 302 additions and 68 deletions

View File

@ -304,10 +304,10 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime)
if (accEvent->mEventRule != AccEvent::eDoNotEmit) {
mDocument->ProcessPendingEvent(accEvent);
AccMutationEvent* showOrhideEvent = downcast_accEvent(accEvent);
if (showOrhideEvent) {
if (showOrhideEvent->mTextChangeEvent)
mDocument->ProcessPendingEvent(showOrhideEvent->mTextChangeEvent);
AccMutationEvent* showOrHideEvent = downcast_accEvent(accEvent);
if (showOrHideEvent) {
if (showOrHideEvent->mTextChangeEvent)
mDocument->ProcessPendingEvent(showOrHideEvent->mTextChangeEvent);
}
}
if (!mDocument)

View File

@ -537,6 +537,22 @@ nsAccessibilityService::UpdateText(nsIPresShell* aPresShell,
document->UpdateText(aContent);
}
void
nsAccessibilityService::UpdateListBullet(nsIPresShell* aPresShell,
nsIContent* aHTMLListItemContent,
bool aHasBullet)
{
nsDocAccessible* document = GetDocAccessible(aPresShell->GetDocument());
if (document) {
nsAccessible* accessible = document->GetAccessible(aHTMLListItemContent);
if (accessible) {
nsHTMLLIAccessible* listItem = accessible->AsHTMLListItem();
if (listItem)
listItem->UpdateBullet(aHasBullet);
}
}
}
void
nsAccessibilityService::PresShellDestroyed(nsIPresShell *aPresShell)
{

View File

@ -120,6 +120,13 @@ public:
virtual void UpdateText(nsIPresShell* aPresShell, nsIContent* aContent);
/**
* Update list bullet accessible.
*/
virtual void UpdateListBullet(nsIPresShell* aPresShell,
nsIContent* aHTMLListItemContent,
bool aHasBullet);
virtual void NotifyOfAnchorJumpTo(nsIContent *aTarget);
virtual void PresShellDestroyed(nsIPresShell* aPresShell);

View File

@ -58,6 +58,7 @@ class AccGroupInfo;
class EmbeddedObjCollector;
class nsAccessible;
class nsHyperTextAccessible;
class nsHTMLLIAccessible;
struct nsRoleMapEntry;
class nsTextAccessible;
@ -364,6 +365,9 @@ public:
inline bool IsHyperText() const { return mFlags & eHyperTextAccessible; }
nsHyperTextAccessible* AsHyperText();
inline bool IsHTMLListItem() const { return mFlags & eHTMLListItemAccessible; }
nsHTMLLIAccessible* AsHTMLListItem();
inline bool IsRoot() const { return mFlags & eRootAccessible; }
nsRootAccessible* AsRoot();
@ -512,8 +516,9 @@ protected:
enum AccessibleTypes {
eApplicationAccessible = 1 << 2,
eHyperTextAccessible = 1 << 3,
eRootAccessible = 1 << 4,
eTextLeafAccessible = 1 << 5
eHTMLListItemAccessible = 1 << 4,
eRootAccessible = 1 << 5,
eTextLeafAccessible = 1 << 6
};
//////////////////////////////////////////////////////////////////////////////

View File

@ -254,12 +254,15 @@ nsHTMLOutputAccessible::GetAttributesInternal(nsIPersistentProperties* aAttribut
nsHTMLLIAccessible::
nsHTMLLIAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
nsHyperTextAccessibleWrap(aContent, aShell)
nsHyperTextAccessibleWrap(aContent, aShell), mBullet(nsnull)
{
mFlags |= eHTMLListItemAccessible;
nsBlockFrame* blockFrame = do_QueryFrame(GetFrame());
if (blockFrame && !blockFrame->BulletIsEmptyExternal()) {
mBulletAccessible = new nsHTMLListBulletAccessible(mContent, mWeakShell);
GetDocAccessible()->BindToDocument(mBulletAccessible, nsnull);
if (blockFrame && blockFrame->HasBullet()) {
mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
if (!GetDocAccessible()->BindToDocument(mBullet, nsnull))
mBullet = nsnull;
}
}
@ -268,13 +271,9 @@ NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLLIAccessible, nsHyperTextAccessible)
void
nsHTMLLIAccessible::Shutdown()
{
if (mBulletAccessible) {
// Ensure that pointer to this is nulled out.
mBulletAccessible->Shutdown();
}
mBullet = nsnull;
nsHyperTextAccessibleWrap::Shutdown();
mBulletAccessible = nsnull;
}
PRUint32
@ -297,12 +296,11 @@ nsHTMLLIAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
NS_IMETHODIMP nsHTMLLIAccessible::GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height)
{
nsresult rv = nsAccessibleWrap::GetBounds(x, y, width, height);
if (NS_FAILED(rv) || !mBulletAccessible) {
if (NS_FAILED(rv) || !mBullet)
return rv;
}
PRInt32 bulletX, bulletY, bulletWidth, bulletHeight;
rv = mBulletAccessible->GetBounds(&bulletX, &bulletY, &bulletWidth, &bulletHeight);
rv = mBullet->GetBounds(&bulletX, &bulletY, &bulletWidth, &bulletHeight);
NS_ENSURE_SUCCESS(rv, rv);
*x = bulletX; // Move x coordinate of list item over to cover bullet as well
@ -310,14 +308,41 @@ NS_IMETHODIMP nsHTMLLIAccessible::GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *wid
return NS_OK;
}
////////////////////////////////////////////////////////////////////////////////
// nsHTMLLIAccessible: public
void
nsHTMLLIAccessible::UpdateBullet(bool aHasBullet)
{
if (aHasBullet == !!mBullet) {
NS_NOTREACHED("Bullet and accessible are in sync already!");
return;
}
nsDocAccessible* document = GetDocAccessible();
if (aHasBullet) {
mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
if (document->BindToDocument(mBullet, nsnull)) {
InsertChildAt(0, mBullet);
}
} else {
RemoveChild(mBullet);
document->UnbindFromDocument(mBullet);
mBullet = nsnull;
}
// XXXtodo: fire show/hide and reorder events. That's hard to make it
// right now because coalescence happens by DOM node.
}
////////////////////////////////////////////////////////////////////////////////
// nsHTMLLIAccessible: nsAccessible protected
void
nsHTMLLIAccessible::CacheChildren()
{
if (mBulletAccessible)
AppendChild(mBulletAccessible);
if (mBullet)
AppendChild(mBullet);
// Cache children from subtree.
nsAccessibleWrap::CacheChildren();
@ -331,19 +356,11 @@ nsHTMLListBulletAccessible::
nsHTMLListBulletAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
nsLeafAccessible(aContent, aShell)
{
mBulletText += ' '; // Otherwise bullets are jammed up against list text
}
////////////////////////////////////////////////////////////////////////////////
// nsHTMLListBulletAccessible: nsAccessNode
void
nsHTMLListBulletAccessible::Shutdown()
{
mBulletText.Truncate();
nsLeafAccessible::Shutdown();
}
bool
nsHTMLListBulletAccessible::IsPrimaryForNode() const
{
@ -363,6 +380,7 @@ nsHTMLListBulletAccessible::GetName(nsAString &aName)
// Native anonymous content, ARIA can't be used. Get list bullet text.
nsBlockFrame* blockFrame = do_QueryFrame(mContent->GetPrimaryFrame());
NS_ASSERTION(blockFrame, "No frame for list item!");
if (blockFrame) {
blockFrame->GetBulletText(aName);
@ -394,17 +412,13 @@ void
nsHTMLListBulletAccessible::AppendTextTo(nsAString& aText, PRUint32 aStartOffset,
PRUint32 aLength)
{
nsAutoString bulletText;
nsBlockFrame* blockFrame = do_QueryFrame(mContent->GetPrimaryFrame());
if (blockFrame) {
nsAutoString bulletText;
NS_ASSERTION(blockFrame, "No frame for list item!");
if (blockFrame)
blockFrame->GetBulletText(bulletText);
PRUint32 maxLength = bulletText.Length() - aStartOffset;
if (aLength > maxLength)
aLength = maxLength;
aText += Substring(bulletText, aStartOffset, aLength);
}
aText.Append(Substring(bulletText, aStartOffset, aLength));
}
////////////////////////////////////////////////////////////////////////////////

View File

@ -136,7 +136,6 @@ public:
NS_IMETHOD GetName(nsAString& aName);
// nsAccessNode
virtual void Shutdown();
virtual bool IsPrimaryForNode() const;
// nsAccessible
@ -144,15 +143,6 @@ public:
virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
virtual void AppendTextTo(nsAString& aText, PRUint32 aStartOffset = 0,
PRUint32 aLength = PR_UINT32_MAX);
protected:
// XXX: Ideally we'd get the bullet text directly from the bullet frame via
// nsBulletFrame::GetListItemText(), but we'd need an interface for getting
// text from contentless anonymous frames. Perhaps something like
// nsIAnonymousFrame::GetText() ? However, in practice storing the bullet text
// here should not be a problem if we invalidate the right parts of
// the accessibility cache when mutation events occur.
nsString mBulletText;
};
/**
@ -182,22 +172,32 @@ public:
// nsISupports
NS_DECL_ISUPPORTS_INHERITED
// nsIAccessible
NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
// nsAccessNode
virtual void Shutdown();
// nsIAccessible
NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
// nsAccessible
virtual PRUint32 NativeRole();
virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
// nsHTMLLIAccessible
void UpdateBullet(bool aHasBullet);
protected:
// nsAccessible
virtual void CacheChildren();
private:
nsRefPtr<nsHTMLListBulletAccessible> mBulletAccessible;
nsRefPtr<nsHTMLListBulletAccessible> mBullet;
};
#endif
inline nsHTMLLIAccessible*
nsAccessible::AsHTMLListItem()
{
return mFlags & eHTMLListItemAccessible ?
static_cast<nsHTMLLIAccessible*>(this) : nsnull;
}
#endif

View File

@ -64,6 +64,10 @@ const STATE_BUSY = nsIAccessibleStates.STATE_BUSY;
const kEmbedChar = String.fromCharCode(0xfffc);
const kDiscBulletText = String.fromCharCode(0x2022) + " ";
const kCircleBulletText = String.fromCharCode(0x25e6) + " ";
const kSquareBulletText = String.fromCharCode(0x25aa) + " ";
/**
* nsIAccessibleRetrieval, initialized when test is loaded.
*/

View File

@ -54,6 +54,7 @@ _TEST_FILES =\
test_general.html \
test_general.xul \
test_link.html \
test_list.html \
test_markup.html \
test_nsRootAcc.xul \
markuprules.xml \

View File

@ -0,0 +1,91 @@
<html>
<head>
<title>nsIAccessible::name calculation for HTML li</title>
<link rel="stylesheet" type="text/css"
href="chrome://mochikit/content/tests/SimpleTest/test.css" />
<script type="application/javascript"
src="chrome://mochikit/content/MochiKit/packed.js"></script>
<script type="application/javascript"
src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
<script type="application/javascript"
src="../common.js"></script>
<script type="application/javascript"
src="../name.js"></script>
<script type="application/javascript"
src="../events.js"></script>
<script type="application/javascript">
/**
* Alter list item numbering and change list style type.
*/
function bulletUpdate()
{
this.eventSeq = [
new invokerChecker(EVENT_REORDER, getNode("list"))
];
this.invoke = function bulletUpdate_invoke()
{
testName("li_end", "1. list end");
var li = document.createElement("li");
li.setAttribute("id", "li_start");
li.textContent = "list start";
getNode("list").insertBefore(li, getNode("li_end"));
}
this.finalCheck = function bulletUpdate_finalCheck()
{
testName("li_start", "1. list start");
testName("li_end", "2. list end");
// change list style type
var list = getNode("list");
list.setAttribute("style", "list-style-type: disc;");
getComputedStyle(list, "").color; // make style processing sync
testName("li_start", kDiscBulletText + "list start");
testName("li_end", kDiscBulletText + "list end");
}
this.getID = function bulletUpdate_getID()
{
return "Update bullet of list items";
}
}
var gQueue = null;
function doTest()
{
gQueue = new eventQueue();
gQueue.push(new bulletUpdate());
gQueue.invoke(); // SimpleTest.finish();
}
SimpleTest.waitForExplicitFinish();
addA11yLoadEvent(doTest);
</script>
</head>
<body>
<a target="_blank"
href="https://bugzilla.mozilla.org/show_bug.cgi?id=634200"
title="crash [@ nsIFrame::GetStyleVisibility() ]">
Mozilla Bug 634200
</a>
<p id="display"></p>
<div id="content" style="display: none"></div>
<pre id="test">
</pre>
<ol id="list">
<li id="li_end">list end</li>
</ol>
</body>
</html>

View File

@ -40,17 +40,13 @@
function doTest()
{
const discBulletText = String.fromCharCode(0x2022) + " ";
const circleBulletText = String.fromCharCode(0x25e6) + " ";
const squareBulletText = String.fromCharCode(0x25aa) + " ";
// list1
var discAccTree = {
role: ROLE_LIST,
children: [
new listItemTree(discBulletText, "Oranges"),
new listItemTree(discBulletText, "Apples"),
new listItemTree(discBulletText, "Bananas")
new listItemTree(kDiscBulletText, "Oranges"),
new listItemTree(kDiscBulletText, "Apples"),
new listItemTree(kDiscBulletText, "Bananas")
]
};
@ -60,9 +56,9 @@
var circleAccTree = {
role: ROLE_LIST,
children: [
new listItemTree(circleBulletText, "Oranges"),
new listItemTree(circleBulletText, "Apples"),
new listItemTree(circleBulletText, "Bananas")
new listItemTree(kCircleBulletText, "Oranges"),
new listItemTree(kCircleBulletText, "Apples"),
new listItemTree(kCircleBulletText, "Bananas")
]
};
@ -72,9 +68,9 @@
var squareAccTree = {
role: ROLE_LIST,
children: [
new listItemTree(squareBulletText, "Oranges"),
new listItemTree(squareBulletText, "Apples"),
new listItemTree(squareBulletText, "Bananas")
new listItemTree(kSquareBulletText, "Oranges"),
new listItemTree(kSquareBulletText, "Apples"),
new listItemTree(kSquareBulletText, "Bananas")
]
};
@ -92,6 +88,43 @@
testAccessibleTree("list4", nestedAccTree);
// dl list
var tree =
{ LIST: [ // dl
{ LISTITEM: [ // dt
{ TEXT_LEAF: [] },
] },
{ PARAGRAPH: [ // dd
{ TEXT_LEAF: [] }
] },
{ LISTITEM: [ // dt
{ TEXT_LEAF: [] }
] },
{ PARAGRAPH: [ // dd
{ TEXT_LEAF: [] }
] }
] };
testAccessibleTree("list5", tree);
// dl list inside ordered list
tree =
{ LIST: [ // ol
{ LISTITEM: [ // li
{ STATICTEXT: [ ] },
{ LIST: [ // dl
{ LISTITEM: [ // dt
{ TEXT_LEAF: [] }
] },
{ PARAGRAPH: [ // dd
{ TEXT_LEAF: [] }
] }
] }
] }
] };
testAccessibleTree("list6", tree);
SimpleTest.finish();
}
@ -111,6 +144,11 @@
href="https://bugzilla.mozilla.org/show_bug.cgi?id=604587">
Mozilla Bug 604587
</a>
<a target="_blank"
title="Fix list bullets for DL list (crash [@ nsBulletFrame::GetListItemText])"
href="https://bugzilla.mozilla.org/show_bug.cgi?id=629114">
Mozilla Bug 629114
</a>
<p id="display"></p>
<div id="content" style="display: none"></div>
<pre id="test">
@ -144,5 +182,18 @@
</ul>
</li>
</ol>
<dl id="list5">
<dt>item1</dt><dd>description</dd>
<dt>item2</td><dd>description</dd>
</dl>
<ol id="list6">
<li>
<dl id="dl">
<dt>item1</dt><dd>description</dd>
</dl>
</li>
</ol>
</body>
</html>

View File

@ -6635,6 +6635,18 @@ nsBlockFrame::GetBulletText(nsAString& aText) const
}
}
bool
nsBlockFrame::HasBullet() const
{
if (mBullet) {
const nsStyleList* styleList = GetStyleList();
return styleList->GetListStyleImage() ||
styleList->mListStyleType != NS_STYLE_LIST_STYLE_NONE;
}
return false;
}
// static
PRBool
nsBlockFrame::FrameStartsCounterScope(nsIFrame* aFrame)

View File

@ -250,12 +250,17 @@ public:
// do we have either a 'list-style-type' or 'list-style-image' that is
// not 'none'?
PRBool BulletIsEmpty() const;
virtual PRBool BulletIsEmptyExternal() const
{
return BulletIsEmpty();
}
/**
* Return the bullet text equivalent.
*/
virtual void GetBulletText(nsAString& aText) const;
/**
* Return true if there's a bullet.
*/
virtual bool HasBullet() const;
virtual void MarkIntrinsicWidthsDirty();
virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
virtual nscoord GetPrefWidth(nsIRenderingContext *aRenderingContext);

View File

@ -62,6 +62,10 @@
#include "nsIComponentManager.h"
#include "nsContentUtils.h"
#ifdef ACCESSIBILITY
#include "nsAccessibilityService.h"
#endif
#define BULLET_FRAME_IMAGE_LOADING NS_FRAME_STATE_BIT(63)
class nsBulletListener : public nsStubImageDecoderObserver
@ -183,6 +187,30 @@ nsBulletFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
mImageRequest = nsnull;
}
}
#ifdef ACCESSIBILITY
// Update the list bullet accessible. If old style list isn't available then
// no need to update the accessible tree because it's not created yet.
if (aOldStyleContext) {
nsAccessibilityService* accService = nsIPresShell::AccService();
if (accService) {
const nsStyleList* oldStyleList = aOldStyleContext->PeekStyleList();
if (oldStyleList) {
bool hadBullet = oldStyleList->GetListStyleImage() ||
oldStyleList->mListStyleType != NS_STYLE_LIST_STYLE_NONE;
const nsStyleList* newStyleList = GetStyleList();
bool hasBullet = newStyleList->GetListStyleImage() ||
newStyleList->mListStyleType != NS_STYLE_LIST_STYLE_NONE;
if (hadBullet != hasBullet) {
accService->UpdateListBullet(PresContext()->GetPresShell(), mContent,
hasBullet);
}
}
}
}
#endif
}
class nsDisplayBullet : public nsDisplayItem {