void AccessibilityMenuList::didUpdateActiveOption(int optionIndex) { Ref<Document> document(m_renderer->document()); AXObjectCache* cache = document->axObjectCache(); const auto& childObjects = children(); if (!childObjects.isEmpty()) { ASSERT(childObjects.size() == 1); ASSERT(childObjects[0]->isMenuListPopup()); // We might be calling this method in situations where the renderers for list items // associated to the menu list have not been created (e.g. they might be rendered // in the UI process, as it's the case in the GTK+ port, which uses GtkMenuItem). // So, we need to make sure that the accessibility popup object has some children // before asking it to update its active option, or it will read invalid memory. // You can reproduce the issue in the GTK+ port by removing this check and running // accessibility/insert-selected-option-into-select-causes-crash.html (will crash). int popupChildrenSize = static_cast<int>(childObjects[0]->children().size()); if (childObjects[0]->isMenuListPopup() && optionIndex >= 0 && optionIndex < popupChildrenSize) { if (AccessibilityMenuListPopup* popup = toAccessibilityMenuListPopup(childObjects[0].get())) popup->didUpdateActiveOption(optionIndex); } } cache->postNotification(this, &document.get(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostSynchronously); }
void AccessibilityMenuList::didUpdateActiveOption(int optionIndex) { Ref<Document> document(m_renderer->document()); AXObjectCache* cache = document->axObjectCache(); const AccessibilityChildrenVector& childObjects = children(); if (!childObjects.isEmpty()) { ASSERT(childObjects.size() == 1); ASSERT(childObjects[0]->isMenuListPopup()); if (childObjects[0]->isMenuListPopup()) { if (AccessibilityMenuListPopup* popup = toAccessibilityMenuListPopup(childObjects[0].get())) popup->didUpdateActiveOption(optionIndex); } } cache->postNotification(this, &document.get(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostSynchronously); }