Code: void DateTimeFieldElement::updateVisibleValue(EventBehavior eventBehavior)
{
    Text* const textNode = toText(firstChild());
    const String newVisibleValue = visibleValue();
    ASSERT(newVisibleValue.length() > 0);

    if (textNode->wholeText() == newVisibleValue)
         return;
 
     textNode->replaceWholeText(newVisibleValue, ASSERT_NO_EXCEPTION);
    setAttribute(aria_valuetextAttr, hasValue() ? newVisibleValue : AXDateTimeFieldEmptyValueText());
    setAttribute(aria_valuenowAttr, newVisibleValue);
 
     if (eventBehavior == DispatchEvent && m_fieldOwner)
         m_fieldOwner->fieldValueChanged();
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation, a different vulnerability than CVE-2012-2874.
Commit Message: INPUT_MULTIPLE_FIELDS_UI: Inconsistent value of aria-valuetext attribute
https://bugs.webkit.org/show_bug.cgi?id=107897

Reviewed by Kentaro Hara.

Source/WebCore:

aria-valuetext and aria-valuenow attributes had inconsistent values in
a case of initial empty state and a case that a user clears a field.

- aria-valuetext attribute should have "blank" message in the initial
  empty state.
- aria-valuenow attribute should be removed in the cleared empty state.

Also, we have a bug that aira-valuenow had a symbolic value such as "AM"
"January". It should always have a numeric value according to the
specification.
http://www.w3.org/TR/wai-aria/states_and_properties#aria-valuenow

No new tests. Updates fast/forms/*-multiple-fields/*-multiple-fields-ax-aria-attributes.html.

* html/shadow/DateTimeFieldElement.cpp:
(WebCore::DateTimeFieldElement::DateTimeFieldElement):
Set "blank" message to aria-valuetext attribute.
(WebCore::DateTimeFieldElement::updateVisibleValue):
aria-valuenow attribute should be a numeric value. Apply String::number
to the return value of valueForARIAValueNow.
Remove aria-valuenow attribute if nothing is selected.
(WebCore::DateTimeFieldElement::valueForARIAValueNow):
Added.
* html/shadow/DateTimeFieldElement.h:
(DateTimeFieldElement): Declare valueForARIAValueNow.

* html/shadow/DateTimeSymbolicFieldElement.cpp:
(WebCore::DateTimeSymbolicFieldElement::valueForARIAValueNow):
Added. Returns 1 + internal selection index.
For example, the function returns 1 for January.
* html/shadow/DateTimeSymbolicFieldElement.h:
(DateTimeSymbolicFieldElement): Declare valueForARIAValueNow.

LayoutTests:

Fix existing tests to show aria-valuenow attribute values.

* fast/forms/resources/multiple-fields-ax-aria-attributes.js: Added.
* fast/forms/date-multiple-fields/date-multiple-fields-ax-aria-attributes-expected.txt:
* fast/forms/date-multiple-fields/date-multiple-fields-ax-aria-attributes.html:
Use multiple-fields-ax-aria-attributes.js.
Add tests for initial empty-value state.
* fast/forms/month-multiple-fields/month-multiple-fields-ax-aria-attributes-expected.txt:
* fast/forms/month-multiple-fields/month-multiple-fields-ax-aria-attributes.html:
Use multiple-fields-ax-aria-attributes.js.
* fast/forms/time-multiple-fields/time-multiple-fields-ax-aria-attributes-expected.txt:
* fast/forms/time-multiple-fields/time-multiple-fields-ax-aria-attributes.html:
Use multiple-fields-ax-aria-attributes.js.


git-svn-id: svn://svn.chromium.org/blink/trunk@140803 bbb929c8-8fbe-4397-9dbb-9b2b20218538