Title: [241494] trunk/Source/WebCore
- Revision
- 241494
- Author
- [email protected]
- Date
- 2019-02-13 19:27:13 -0800 (Wed, 13 Feb 2019)
Log Message
AX: Crash in handleMenuOpen
https://bugs.webkit.org/show_bug.cgi?id=194627
Reviewed by Zalan Bujtas.
Tests run under libGuardMalloc will cause crashes.
This list of objects is a Node list, not an Element list, so we were
not removing some nodes when they were being deallocated.
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::remove):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (241493 => 241494)
--- trunk/Source/WebCore/ChangeLog 2019-02-14 03:01:25 UTC (rev 241493)
+++ trunk/Source/WebCore/ChangeLog 2019-02-14 03:27:13 UTC (rev 241494)
@@ -1,3 +1,18 @@
+2019-02-13 Chris Fleizach <[email protected]>
+
+ AX: Crash in handleMenuOpen
+ https://bugs.webkit.org/show_bug.cgi?id=194627
+
+ Reviewed by Zalan Bujtas.
+
+ Tests run under libGuardMalloc will cause crashes.
+
+ This list of objects is a Node list, not an Element list, so we were
+ not removing some nodes when they were being deallocated.
+
+ * accessibility/AXObjectCache.cpp:
+ (WebCore::AXObjectCache::remove):
+
2019-02-13 Jer Noble <[email protected]>
[Mac] PiP window can get "stuck" if PiP is closed while Safari window is minimized.
Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (241493 => 241494)
--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2019-02-14 03:01:25 UTC (rev 241493)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2019-02-14 03:27:13 UTC (rev 241494)
@@ -747,10 +747,10 @@
if (is<Element>(node)) {
m_deferredRecomputeIsIgnoredList.remove(downcast<Element>(&node));
m_deferredSelectedChildredChangedList.remove(downcast<Element>(&node));
- m_deferredChildrenChangedNodeList.remove(&node);
m_deferredTextFormControlValue.remove(downcast<Element>(&node));
m_deferredAttributeChange.remove(downcast<Element>(&node));
}
+ m_deferredChildrenChangedNodeList.remove(&node);
m_deferredTextChangedList.remove(&node);
// Remove the entry if the new focused node is being removed.
m_deferredFocusedNodeChange.removeAllMatching([&node](auto& entry) -> bool {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
