Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 78912d5d9c571a8af6807cb6fddc8329e49a5462
https://github.com/WebKit/WebKit/commit/78912d5d9c571a8af6807cb6fddc8329e49a5462
Author: Tyler Wilcock <[email protected]>
Date: 2026-04-13 (Mon, 13 Apr 2026)
Changed paths:
M Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h
Log Message:
-----------
AX: crossFrameParentObject() and crossFrameChildObject() use the AXTreeStore
without taking the lock, which is unsafe
https://bugs.webkit.org/show_bug.cgi?id=312188
rdar://174685148
Reviewed by Chris Fleizach.
Change these callsites to use treeForFrameID, which acquires the lock.
* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp:
(WebCore::AXIsolatedObject::crossFrameParentObject const):
(WebCore::AXIsolatedObject::crossFrameChildObject const):
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::treeForFrameIDAlreadyLocked): Deleted.
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h:
Canonical link: https://commits.webkit.org/311175@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
