Title: [261482] trunk/Source/WebCore
Revision
261482
Author
andresg...@apple.com
Date
2020-05-11 10:54:33 -0700 (Mon, 11 May 2020)

Log Message

Check the validity of the underlying Document before updating the isolated tree.
https://bugs.webkit.org/show_bug.cgi?id=211728

Reviewed by Chris Fleizach.

Solves crashes in isolated tree mode for several LayoutTests.

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::focusedUIElementForPage): Update the focused
document styles before returning the isolated tree focused object.

(WebCore::AXObjectCache::notificationPostTimerFired): Ignored
notification if underlying Document doesn't have a living render tree.

* accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::updateChildren): Don't update isolated object
if associated AXObject doesn't have a Document or the Document doesn't have a live render tree.

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (261481 => 261482)


--- trunk/Source/WebCore/ChangeLog	2020-05-11 16:26:59 UTC (rev 261481)
+++ trunk/Source/WebCore/ChangeLog	2020-05-11 17:54:33 UTC (rev 261482)
@@ -1,5 +1,25 @@
 2020-05-11  Andres Gonzalez  <andresg...@apple.com>
 
+        Check the validity of the underlying Document before updating the isolated tree.
+        https://bugs.webkit.org/show_bug.cgi?id=211728
+
+        Reviewed by Chris Fleizach.
+
+        Solves crashes in isolated tree mode for several LayoutTests.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::focusedUIElementForPage): Update the focused
+        document styles before returning the isolated tree focused object.
+
+        (WebCore::AXObjectCache::notificationPostTimerFired): Ignored
+        notification if underlying Document doesn't have a living render tree.
+
+        * accessibility/isolatedtree/AXIsolatedTree.cpp:
+        (WebCore::AXIsolatedTree::updateChildren): Don't update isolated object
+        if associated AXObject doesn't have a Document or the Document doesn't have a live render tree.
+
+2020-05-11  Andres Gonzalez  <andresg...@apple.com>
+
         Add mechanism to turn on accessibility isolated tree mode from WebKitTestRunner.
         https://bugs.webkit.org/show_bug.cgi?id=211725
 

Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (261481 => 261482)


--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp	2020-05-11 16:26:59 UTC (rev 261481)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp	2020-05-11 17:54:33 UTC (rev 261482)
@@ -405,17 +405,18 @@
     if (!gAccessibilityEnabled)
         return nullptr;
 
-#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
-    if (isIsolatedTreeEnabled())
-        return isolatedTreeFocusedObject();
-#endif
-
     // get the focused node in the page
     Document* focusedDocument = page->focusController().focusedOrMainFrame().document();
     if (!focusedDocument)
         return nullptr;
 
+    // Call this before isolated or non-isolated cases so the document is up to do.
     focusedDocument->updateStyleIfNeeded();
+    
+#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
+    if (isIsolatedTreeEnabled())
+        return isolatedTreeFocusedObject();
+#endif
 
     return focusedObject(*focusedDocument);
 }
@@ -1010,6 +1011,8 @@
 {
     Ref<Document> protectorForCacheOwner(m_document);
     m_notificationPostTimer.stop();
+    if (!m_document.hasLivingRenderTree())
+        return;
     
     // In tests, posting notifications has a tendency to immediately queue up other notifications, which can lead to unexpected behavior
     // when the notification list is cleared at the end. Instead copy this list at the start.

Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp (261481 => 261482)


--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp	2020-05-11 16:26:59 UTC (rev 261481)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp	2020-05-11 17:54:33 UTC (rev 261482)
@@ -229,8 +229,10 @@
 {
     AXTRACE("AXIsolatedTree::updateChildren");
     ASSERT(isMainThread());
+    if (!axObject.document() || !axObject.document()->hasLivingRenderTree())
+        return;
+
     AXID axObjectID = axObject.objectID();
-
     LockHolder locker { m_changeLogLock };
     auto object = nodeForID(axObjectID);
     if (!object)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to