- Revision
- 259288
- Author
- [email protected]
- Date
- 2020-03-31 07:52:40 -0700 (Tue, 31 Mar 2020)
Log Message
The relative frame and hit test of isolated objects must be dispatched to the main thread.
https://bugs.webkit.org/show_bug.cgi?id=209792
Reviewed by Chris Fleizach.
The relative frame of isolated objects must be calculated on the main
thread because it requires the scroll ancestor to convert to the
appropriate scroll offset. The relative frame cannot be cached because
the scroll offset can change.
Accordingly, the hit test cannot rely on a cached relative frame and
must be dispatched to be computed on the main thread as well.
* accessibility/AXObjectCache.h:
* accessibility/isolatedtree/AXIsolatedObject.cpp:
(WebCore::AXIsolatedObject::initializeAttributeData): Do not cache the relative frame any longer.
(WebCore::AXIsolatedObject::accessibilityHitTest const): Dispatched to the main thread.
(WebCore::AXIsolatedObject::relativeFrame const): Dispatched to the main thread.
* accessibility/isolatedtree/AXIsolatedObject.h:
* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper position]):
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
(-[WebAccessibilityObjectWrapper accessibilityHitTest:]):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (259287 => 259288)
--- trunk/Source/WebCore/ChangeLog 2020-03-31 14:20:40 UTC (rev 259287)
+++ trunk/Source/WebCore/ChangeLog 2020-03-31 14:52:40 UTC (rev 259288)
@@ -1,3 +1,28 @@
+2020-03-31 Andres Gonzalez <[email protected]>
+
+ The relative frame and hit test of isolated objects must be dispatched to the main thread.
+ https://bugs.webkit.org/show_bug.cgi?id=209792
+
+ Reviewed by Chris Fleizach.
+
+ The relative frame of isolated objects must be calculated on the main
+ thread because it requires the scroll ancestor to convert to the
+ appropriate scroll offset. The relative frame cannot be cached because
+ the scroll offset can change.
+ Accordingly, the hit test cannot rely on a cached relative frame and
+ must be dispatched to be computed on the main thread as well.
+
+ * accessibility/AXObjectCache.h:
+ * accessibility/isolatedtree/AXIsolatedObject.cpp:
+ (WebCore::AXIsolatedObject::initializeAttributeData): Do not cache the relative frame any longer.
+ (WebCore::AXIsolatedObject::accessibilityHitTest const): Dispatched to the main thread.
+ (WebCore::AXIsolatedObject::relativeFrame const): Dispatched to the main thread.
+ * accessibility/isolatedtree/AXIsolatedObject.h:
+ * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+ (-[WebAccessibilityObjectWrapper position]):
+ (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
+ (-[WebAccessibilityObjectWrapper accessibilityHitTest:]):
+
2020-03-31 Antti Koivisto <[email protected]>
Nullptr crash in InlineTextBox::emphasisMarkExistsAndIsAbove
Modified: trunk/Source/WebCore/accessibility/AXObjectCache.h (259287 => 259288)
--- trunk/Source/WebCore/accessibility/AXObjectCache.h 2020-03-31 14:20:40 UTC (rev 259287)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.h 2020-03-31 14:52:40 UTC (rev 259288)
@@ -358,8 +358,8 @@
AXCoreObject* isolatedTreeRootObject();
AXCoreObject* isolatedTreeFocusedObject();
void setIsolatedTreeFocusedObject(Node*);
+ static Ref<AXIsolatedTree> generateIsolatedTree(PageIdentifier, Document&);
RefPtr<AXIsolatedTree> getOrCreateIsolatedTree() const;
- static Ref<AXIsolatedTree> generateIsolatedTree(PageIdentifier, Document&);
void updateIsolatedTree(AXCoreObject&, AXNotification);
void updateIsolatedTree(const Vector<std::pair<RefPtr<AXCoreObject>, AXNotification>>&);
static void initializeSecondaryAXThread();
Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp (259287 => 259288)
--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp 2020-03-31 14:20:40 UTC (rev 259287)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp 2020-03-31 14:52:40 UTC (rev 259288)
@@ -121,7 +121,6 @@
setProperty(AXPropertyName::IsValueAutofilled, object.isValueAutofilled());
setProperty(AXPropertyName::IsVisible, object.isVisible());
setProperty(AXPropertyName::IsVisited, object.isVisited());
- setProperty(AXPropertyName::RelativeFrame, object.relativeFrame());
setProperty(AXPropertyName::RoleDescription, object.roleDescription().isolatedCopy());
setProperty(AXPropertyName::RolePlatformString, object.rolePlatformString().isolatedCopy());
setProperty(AXPropertyName::RoleValue, static_cast<int>(object.roleValue()));
@@ -700,15 +699,17 @@
AXCoreObject* AXIsolatedObject::accessibilityHitTest(const IntPoint& point) const
{
- if (!relativeFrame().contains(point))
- return nullptr;
- for (const auto& childID : m_childrenIDs) {
- auto child = tree()->nodeForID(childID);
- ASSERT(child);
- if (child && child->relativeFrame().contains(point))
- return child->accessibilityHitTest(point);
- }
- return const_cast<AXIsolatedObject*>(this);
+ AXID axID = Accessibility::retrieveValueFromMainThread<AXID>([&point, this] () -> AXID {
+ if (auto* object = associatedAXObject()) {
+ object->updateChildrenIfNecessary();
+ if (auto* axObject = object->accessibilityHitTest(point))
+ return axObject->objectID();
+ }
+
+ return InvalidAXID;
+ });
+
+ return tree()->nodeForID(axID).get();
}
IntPoint AXIsolatedObject::intPointAttributeValue(AXPropertyName propertyName) const
@@ -910,6 +911,16 @@
Accessibility::findMatchingObjects(*criteria, results);
}
+FloatRect AXIsolatedObject::relativeFrame() const
+{
+ // Retrieve this on the main thread because we require the scroll ancestor to convert to the right scroll offset.
+ return Accessibility::retrieveValueFromMainThread<FloatRect>([this] () -> FloatRect {
+ if (auto* axObject = associatedAXObject())
+ return axObject->relativeFrame();
+ return { };
+ });
+}
+
bool AXIsolatedObject::replaceTextInRange(const String&, const PlainTextRange&)
{
ASSERT_NOT_REACHED();
Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h (259287 => 259288)
--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h 2020-03-31 14:20:40 UTC (rev 259287)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h 2020-03-31 14:52:40 UTC (rev 259288)
@@ -282,7 +282,6 @@
PosInSet,
PreventKeyboardDOMEventDispatch,
ReadOnlyValue,
- RelativeFrame,
#if PLATFORM(COCOA)
RemoteParentObject,
#endif
@@ -463,7 +462,7 @@
bool isRequired() const override { return boolAttributeValue(AXPropertyName::IsRequired); }
bool supportsRequiredAttribute() const override { return boolAttributeValue(AXPropertyName::SupportsRequiredAttribute); }
bool isExpanded() const override { return boolAttributeValue(AXPropertyName::IsExpanded); }
- FloatRect relativeFrame() const override { return rectAttributeValue<FloatRect>(AXPropertyName::RelativeFrame); }
+ FloatRect relativeFrame() const override;
bool supportsDatetimeAttribute() const override { return boolAttributeValue(AXPropertyName::SupportsDatetimeAttribute); }
String datetimeAttributeValue() const override { return stringAttributeValue(AXPropertyName::DatetimeAttributeValue); }
bool canSetFocusAttribute() const override { return boolAttributeValue(AXPropertyName::CanSetFocusAttribute); }
Modified: trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm (259287 => 259288)
--- trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm 2020-03-31 14:20:40 UTC (rev 259287)
+++ trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm 2020-03-31 14:52:40 UTC (rev 259288)
@@ -1982,7 +1982,7 @@
if (_AXUIElementRequestServicedBySecondaryAXThread())
return [NSValue valueWithPoint:(NSPoint)self.axBackingObject->relativeFrame().location()];
#endif
-
+
auto rect = snappedIntRect(self.axBackingObject->elementRect());
// The Cocoa accessibility API wants the lower-left corner.
@@ -3063,7 +3063,7 @@
}
if ([attributeName isEqualToString:NSAccessibilityRelativeFrameAttribute])
- return [NSValue valueWithRect:NSRectFromCGRect(backingObject->relativeFrame())];
+ return [NSValue valueWithRect:(NSRect)backingObject->relativeFrame()];
if ([attributeName isEqualToString:@"AXErrorMessageElements"]) {
AccessibilityObject::AccessibilityChildrenVector errorMessages;
@@ -3135,6 +3135,7 @@
backingObject->updateChildrenIfNecessary();
AXCoreObject* axObject = backingObject->accessibilityHitTest(IntPoint(point));
+
if (axObject) {
if (axObject->isAttachment() && [axObject->wrapper() attachmentView])
return [axObject->wrapper() attachmentView];
