Title: [258560] trunk/Source/WebCore
- Revision
- 258560
- Author
- andresg...@apple.com
- Date
- 2020-03-17 11:07:10 -0700 (Tue, 17 Mar 2020)
Log Message
AXIsolatedTree removal should set all nodes to be removed on AX secondary thread.
https://bugs.webkit.org/show_bug.cgi?id=209169
Reviewed by Chris Fleizach.
- AXIsolatedTree::removeTreeForPageID is called on the main thread but
it should not remove the nodes in the main thread, but instead add them
to the pending changes to be removed on the secondary thread. This was
causing the problem of empty new trees when the old tree would go away
but the client was holding a reference to an object that has been
disconnected and thus had no children.
- In addition, this change fixes an isolated tree mode crash in AccessibilityMenuList.
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::~AXObjectCache):
* accessibility/AccessibilityMenuList.cpp:
(WebCore::AccessibilityMenuList::isCollapsed const):
* accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::removeTreeForPageID):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (258559 => 258560)
--- trunk/Source/WebCore/ChangeLog 2020-03-17 17:28:55 UTC (rev 258559)
+++ trunk/Source/WebCore/ChangeLog 2020-03-17 18:07:10 UTC (rev 258560)
@@ -1,3 +1,25 @@
+2020-03-17 Andres Gonzalez <andresg...@apple.com>
+
+ AXIsolatedTree removal should set all nodes to be removed on AX secondary thread.
+ https://bugs.webkit.org/show_bug.cgi?id=209169
+
+ Reviewed by Chris Fleizach.
+
+ - AXIsolatedTree::removeTreeForPageID is called on the main thread but
+ it should not remove the nodes in the main thread, but instead add them
+ to the pending changes to be removed on the secondary thread. This was
+ causing the problem of empty new trees when the old tree would go away
+ but the client was holding a reference to an object that has been
+ disconnected and thus had no children.
+ - In addition, this change fixes an isolated tree mode crash in AccessibilityMenuList.
+
+ * accessibility/AXObjectCache.cpp:
+ (WebCore::AXObjectCache::~AXObjectCache):
+ * accessibility/AccessibilityMenuList.cpp:
+ (WebCore::AccessibilityMenuList::isCollapsed const):
+ * accessibility/isolatedtree/AXIsolatedTree.cpp:
+ (WebCore::AXIsolatedTree::removeTreeForPageID):
+
2020-03-17 Jacob Uphoff <jacob_uph...@apple.com>
Unreviewed, reverting r257844.
Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (258559 => 258560)
--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2020-03-17 17:28:55 UTC (rev 258559)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2020-03-17 18:07:10 UTC (rev 258560)
@@ -235,14 +235,13 @@
m_focusModalNodeTimer.stop();
m_performCacheUpdateTimer.stop();
+ for (const auto& object : m_objects.values())
+ object->detach(AccessibilityDetachmentType::CacheDestroyed);
+
#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
- // Destroy the IsolatedTree before destroying the live tree.
if (m_pageID)
AXIsolatedTree::removeTreeForPageID(*m_pageID);
#endif
-
- for (const auto& object : m_objects.values())
- object->detach(AccessibilityDetachmentType::CacheDestroyed);
}
void AXObjectCache::findModalNodes()
Modified: trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp (258559 => 258560)
--- trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2020-03-17 17:28:55 UTC (rev 258559)
+++ trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2020-03-17 18:07:10 UTC (rev 258560)
@@ -99,7 +99,10 @@
bool AccessibilityMenuList::isCollapsed() const
{
#if !PLATFORM(IOS_FAMILY)
- return !static_cast<RenderMenuList*>(renderer())->popupIsVisible();
+ auto* renderer = this->renderer();
+ if (is<RenderMenuList>(renderer))
+ return !downcast<RenderMenuList>(*renderer).popupIsVisible();
+ return true;
#else
return true;
#endif
Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp (258559 => 258560)
--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp 2020-03-17 17:28:55 UTC (rev 258559)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp 2020-03-17 18:07:10 UTC (rev 258560)
@@ -102,18 +102,15 @@
void AXIsolatedTree::removeTreeForPageID(PageIdentifier pageID)
{
+ ASSERT(isMainThread());
LockHolder locker(s_cacheLock);
if (auto optionalTree = treePageCache().take(pageID)) {
auto& tree { *optionalTree };
+
LockHolder treeLocker { tree->m_changeLogLock };
- for (const auto& axID : tree->m_readerThreadNodeMap.keys()) {
- if (auto object = tree->nodeForID(axID))
- object->detach(AccessibilityDetachmentType::CacheDestroyed);
- }
- tree->m_pendingAppends.clear();
- tree->m_pendingRemovals.clear();
- tree->m_readerThreadNodeMap.clear();
+ tree->m_pendingRemovals.append(tree->m_rootNodeID);
+ tree->setAXObjectCache(nullptr);
treeLocker.unlockEarly();
treeIDCache().remove(tree->treeIdentifier());
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
