Diff
Modified: trunk/Source/WebCore/ChangeLog (266135 => 266136)
--- trunk/Source/WebCore/ChangeLog 2020-08-25 18:37:45 UTC (rev 266135)
+++ trunk/Source/WebCore/ChangeLog 2020-08-25 18:46:58 UTC (rev 266136)
@@ -1,3 +1,46 @@
+2020-08-25 Andres Gonzalez <[email protected]>
+
+ Crash in WebCore::AccessibilityRenderObject::textUnderElement in isolated tree mode.
+ https://bugs.webkit.org/show_bug.cgi?id=215790
+
+ Reviewed by Darin Adler.
+
+ This crash is happening in isolated tree mode because AXIsolatedObject::initializeAttributeData
+ is caching all properties of the object on a checked state changed notification.
+ In some cases like the web page in the bug report, not all properties
+ can be computed in the notification handler. In particular AccessibilityRenderObject::textUnderElement
+ does the following checks:
+
+ // Renders referenced by accessibility objects could get destroyed, if TextIterator ends up triggering
+ // style update/layout here. See also AXObjectCache::deferTextChangedIfNeeded().
+ ASSERT_WITH_SECURITY_IMPLICATION(!nodeDocument->childNeedsStyleRecalc());
+ ASSERT_WITH_SECURITY_IMPLICATION(!nodeDocument->view()->layoutContext().isInRenderTreeLayout());
+
+ This patch addresses this problem by only updating the checked state
+ property of the isolated object, instead of all properties, in the
+ checked state change notification.
+ This is also a performance enhancement since only the property that
+ changed is re-calculated. The same approach will be used for other properties.
+
+ * accessibility/AXObjectCache.cpp:
+ (WebCore::AXObjectCache::updateIsolatedTree): Checked state changed notifications
+ trigger an update of the corresponding isolated object's chekced state
+ instead of the creation of a new object and re-calculation of all cached properties.
+ * accessibility/isolatedtree/AXIsolatedObject.cpp:
+ (WebCore::AXIsolatedObject::setProperty): Removed ASSERT since it is now
+ called in applyPendingChanges on the secondary thread.
+ * accessibility/isolatedtree/AXIsolatedObject.h: Moved the AXPropertyName
+ enumeration, the AttributeValueVariant and attribute map declarations
+ out of this header into AXIsolatedTree.h in order to be able to use them
+ in both classes.
+ * accessibility/isolatedtree/AXIsolatedTree.cpp:
+ (WebCore::AXIsolatedTree::updateNode): Removed unnecessary scope operator.
+ (WebCore::AXIsolatedTree::updateNodeCheckedState): Added.
+ (WebCore::AXIsolatedTree::applyPendingChanges): Added updating the pending
+ properties on the secondary thread.
+ * accessibility/isolatedtree/AXIsolatedTree.h: Moved to this header the declarations
+ that are now shared by AXIsolatedObject and AXIsolatedTree.
+
2020-08-25 Youenn Fablet <[email protected]>
Refresh ReadableStream.pipeTo implementation up to spec
Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (266135 => 266136)
--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2020-08-25 18:37:45 UTC (rev 266135)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2020-08-25 18:46:58 UTC (rev 266136)
@@ -3200,6 +3200,8 @@
switch (notification) {
case AXCheckedStateChanged:
+ tree->updateNodeCheckedState(object);
+ break;
case AXSelectedTextChanged:
case AXValueChanged:
tree->updateNode(object);
@@ -3260,6 +3262,8 @@
switch (notification.second) {
case AXCheckedStateChanged:
+ tree->updateNodeCheckedState(*notification.first);
+ break;
case AXSelectedTextChanged:
case AXValueChanged: {
bool needsUpdate = appendIfNotContainsMatching(filteredNotifications, notification, [¬ification] (const std::pair<RefPtr<AXCoreObject>, AXNotification>& note) {
Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp (266135 => 266136)
--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp 2020-08-25 18:37:45 UTC (rev 266135)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp 2020-08-25 18:46:58 UTC (rev 266136)
@@ -450,10 +450,8 @@
setProperty(propertyName, childIDs);
}
-void AXIsolatedObject::setProperty(AXPropertyName propertyName, AttributeValueVariant&& value, bool shouldRemove)
+void AXIsolatedObject::setProperty(AXPropertyName propertyName, AXPropertyValueVariant&& value, bool shouldRemove)
{
- ASSERT(isMainThread());
-
if (shouldRemove)
m_attributeMap.remove(propertyName);
else
Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h (266135 => 266136)
--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h 2020-08-25 18:37:45 UTC (rev 266135)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h 2020-08-25 18:46:58 UTC (rev 266136)
@@ -87,276 +87,7 @@
return m_id != InvalidAXID ? axObjectCache()->objectFromAXID(m_id) : nullptr;
}
- enum class AXPropertyName : uint16_t {
- None = 0,
- ARIAControlsElements,
- ARIADetailsElements,
- DropEffects,
- ARIAErrorMessageElements,
- ARIAIsMultiline,
- ARIAFlowToElements,
- ARIALandmarkRoleDescription,
- ARIATreeItemContent,
- ARIATreeRows,
- ARIARoleAttribute,
- ARIAOwnsElements,
- AXColumnCount,
- AXColumnIndex,
- AXRowCount,
- AXRowIndex,
- AccessKey,
- AccessibilityButtonState,
- AccessibilityDescription,
- AccessibilityText,
- ActionVerb,
- AutoCompleteValue,
- BlockquoteLevel,
- BoundingBoxRect,
- CanHaveSelectedChildren,
- CanSetExpandedAttribute,
- CanSetFocusAttribute,
- CanSetNumericValue,
- CanSetSelectedAttribute,
- CanSetSelectedChildrenAttribute,
- CanSetTextRangeAttributes,
- CanSetValueAttribute,
- CanvasHasFallbackContent,
-#if PLATFORM(COCOA) && !PLATFORM(IOS_FAMILY)
- CaretBrowsingEnabled,
-#endif
- Cells,
- ClassList,
- ClickPoint,
- ColorValue,
- Columns,
- ColumnCount,
- ColumnHeader,
- ColumnHeaders,
- ColumnIndex,
- ColumnIndexRange,
- ComputedLabel,
- ComputedRoleString,
- CurrentState,
- CurrentValue,
- DatetimeAttributeValue,
- DecrementButton,
- Description,
- DisclosedByRow,
- DisclosedRows,
- DocumentEncoding,
- DocumentLinks,
- DocumentURI,
- EditableAncestor,
- ElementRect,
- EstimatedLoadingProgress,
- ExpandedTextValue,
- ExposesTitleUIElement,
- FileUploadButtonReturnsValueInTitle,
- FocusableAncestor,
- HasARIAValueNow,
- HasApplePDFAnnotationAttribute,
- HasBoldFont,
- HasChildren,
- HasHighlighting,
- HasItalicFont,
- HasPlainText,
- HasPopup,
- HasUnderline,
- HeaderContainer,
- HeadingLevel,
- HelpText,
- HierarchicalLevel,
- HighestEditableAncestor,
- HorizontalScrollBar,
- IdentifierAttribute,
- InvalidStatus,
- IncrementButton,
- IsAccessibilityIgnored,
- IsActiveDescendantOfFocusedContainer,
- IsAnonymousMathOperator,
- IsGrabbed,
- IsARIATreeGridRow,
- IsAttachment,
- IsButton,
- IsBusy,
- IsChecked,
- IsCollapsed,
- IsColumnHeaderCell,
- IsControl,
- IsDataTable,
- IsDescriptionList,
- IsEnabled,
- IsExpanded,
- IsExposable,
- IsFieldset,
- IsFileUploadButton,
- IsFocused,
- IsGroup,
- IsImageMapLink,
- IsIncrementor,
- IsIndeterminate,
- IsInlineText,
- IsInputImage,
- IsInsideLiveRegion,
- IsHeading,
- IsHovered,
- IsKeyboardFocusable,
- IsLandmark,
- IsLink,
- IsLinked,
- IsList,
- IsListBox,
- IsLoaded,
- IsMathElement,
- IsMathFraction,
- IsMathFenced,
- IsMathSubscriptSuperscript,
- IsMathRow,
- IsMathUnderOver,
- IsMathRoot,
- IsMathSquareRoot,
- IsMathText,
- IsMathNumber,
- IsMathOperator,
- IsMathFenceOperator,
- IsMathSeparatorOperator,
- IsMathIdentifier,
- IsMathTable,
- IsMathTableRow,
- IsMathTableCell,
- IsMathMultiscript,
- IsMathToken,
- IsMathScriptObject,
- IsMediaTimeline,
- IsMenu,
- IsMenuBar,
- IsMenuButton,
- IsMenuItem,
- IsMenuList,
- IsMenuListOption,
- IsMenuListPopup,
- IsMenuRelated,
- IsMeter,
- IsMultiSelectable,
- IsOrderedList,
- IsOutput,
- IsPasswordField,
- IsPressed,
- IsProgressIndicator,
- IsRangeControl,
- IsRequired,
- IsRowHeaderCell,
- IsScrollbar,
- IsSearchField,
- IsSelected,
- IsSelectedOptionActive,
- IsShowingValidationMessage,
- IsSlider,
- IsStyleFormatGroup,
- IsTable,
- IsTableCell,
- IsTableColumn,
- IsTableRow,
- IsTextControl,
- IsTree,
- IsTreeItem,
- IsUnorderedList,
- IsUnvisited,
- IsValueAutofilled,
- IsValueAutofillAvailable,
- IsVisible,
- IsVisited,
- KeyShortcutsValue,
- Language,
- LayoutCount,
- LinkRelValue,
- LinkedUIElements,
- LiveRegionAtomic,
- LiveRegionRelevant,
- LiveRegionStatus,
- MathFencedOpenString,
- MathFencedCloseString,
- MathLineThickness,
- MathPrescripts,
- MathPostscripts,
- MathRadicandObject,
- MathRootIndexObject,
- MathUnderObject,
- MathOverObject,
- MathNumeratorObject,
- MathDenominatorObject,
- MathBaseObject,
- MathSubscriptObject,
- MathSuperscriptObject,
- MaxValueForRange,
- MinValueForRange,
- Orientation,
- Path,
- PlaceholderValue,
- PressedIsPresent,
- PopupValue,
- PosInSet,
- PreventKeyboardDOMEventDispatch,
- ReadOnlyValue,
- RoleValue,
- RolePlatformString,
- RoleDescription,
- Rows,
- RowCount,
- RowHeaders,
- RowIndex,
- RowIndexRange,
- SelectedChildren,
- SelectedRadioButton,
- SelectedTabItem,
- SessionID,
- SetSize,
- SortDirection,
- SpeakAs,
- SpeechHint,
- StringValue,
- SupportsRowCountChange,
- SupportsDragging,
- SupportsDropping,
- SupportsARIAOwns,
- SupportsCurrent,
- SupportsDatetimeAttribute,
- SupportsExpanded,
- SupportsExpandedTextValue,
- SupportsLiveRegion,
- SupportsPath,
- SupportsPosInSet,
- SupportsPressAction,
- SupportsRangeValue,
- SupportsRequiredAttribute,
- SupportsSelectedRows,
- SupportsSetSize,
- TabChildren,
- TableLevel,
- TagName,
- TextLength,
- Title,
- TitleAttributeValue,
- TitleUIElement,
- URL,
- ValueAutofillButtonType,
- ValueDescription,
- ValueForRange,
- ValidationMessage,
- VerticalScrollBar,
- VisibleChildren,
- VisibleRows,
- WebArea,
- };
-
- typedef std::pair<AXID, AXID> AccessibilityIsolatedTreeMathMultiscriptPair;
- struct AccessibilityIsolatedTreeText {
- String text;
- AccessibilityTextSource textSource;
- };
-
- using AttributeValueVariant = Variant<std::nullptr_t, String, bool, int, unsigned, double, float, uint64_t, Color, URL, LayoutRect, FloatRect, AXID, IntPoint, OptionSet<SpeakAs>, std::pair<unsigned, unsigned>, Vector<AccessibilityIsolatedTreeText>, Vector<AXID>, Vector<AccessibilityIsolatedTreeMathMultiscriptPair>, Vector<String>, Path>;
- void setProperty(AXPropertyName, AttributeValueVariant&&, bool shouldRemove = false);
+ void setProperty(AXPropertyName, AXPropertyValueVariant&&, bool shouldRemove = false);
void setObjectProperty(AXPropertyName, AXCoreObject*);
void setObjectVectorProperty(AXPropertyName, const AccessibilityChildrenVector&);
@@ -919,8 +650,8 @@
AXID m_id { InvalidAXID };
Vector<AXID> m_childrenIDs;
Vector<RefPtr<AXCoreObject>> m_children;
+ AXPropertyMap m_attributeMap;
- HashMap<AXPropertyName, AttributeValueVariant, WTF::IntHash<AXPropertyName>, WTF::StrongEnumHashTraits<AXPropertyName>> m_attributeMap;
#if PLATFORM(COCOA)
RetainPtr<NSView> m_platformWidget;
RetainPtr<RemoteAXObjectRef> m_remoteParent;
Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp (266135 => 266136)
--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp 2020-08-25 18:37:45 UTC (rev 266135)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp 2020-08-25 18:46:58 UTC (rev 266136)
@@ -237,14 +237,23 @@
auto newObject = AXIsolatedObject::create(axObject, m_treeID, parentID);
newObject->m_childrenIDs = axObject.childrenIDs();
- {
- LockHolder locker { m_changeLogLock };
- // Remove the old object and set the new one to be updated on the AX thread.
- m_pendingNodeRemovals.append(axID);
- m_pendingAppends.append(NodeChange(newObject, axObject.wrapper()));
- }
+ LockHolder locker { m_changeLogLock };
+ // Remove the old object and set the new one to be updated on the AX thread.
+ m_pendingNodeRemovals.append(axID);
+ m_pendingAppends.append(NodeChange(newObject, axObject.wrapper()));
}
+void AXIsolatedTree::updateNodeCheckedState(const AXCoreObject& axObject)
+{
+ AXTRACE("AXIsolatedTree::updateNodeCheckedState");
+ ASSERT(isMainThread());
+
+ AXPropertyMap propertyMap;
+ propertyMap.set(AXPropertyName::IsChecked, axObject.isChecked());
+ LockHolder locker { m_changeLogLock };
+ m_pendingPropertyChanges.append({ axObject.objectID(), propertyMap });
+}
+
void AXIsolatedTree::updateSubtree(AXCoreObject& axObject)
{
AXTRACE("AXIsolatedTree::updateSubtree");
@@ -473,6 +482,14 @@
object->setChildrenIDs(WTFMove(update.second));
}
m_pendingChildrenUpdates.clear();
+
+ for (auto& change : m_pendingPropertyChanges) {
+ if (auto object = nodeForID(change.axID)) {
+ for (auto& property : change.properties)
+ object->setProperty(property.key, WTFMove(property.value));
+ }
+ }
+ m_pendingPropertyChanges.clear();
}
} // namespace WebCore
Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h (266135 => 266136)
--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h 2020-08-25 18:37:45 UTC (rev 266135)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h 2020-08-25 18:46:58 UTC (rev 266136)
@@ -45,6 +45,283 @@
typedef unsigned AXIsolatedTreeID;
+enum class AXPropertyName : uint16_t {
+ None = 0,
+ ARIAControlsElements,
+ ARIADetailsElements,
+ DropEffects,
+ ARIAErrorMessageElements,
+ ARIAIsMultiline,
+ ARIAFlowToElements,
+ ARIALandmarkRoleDescription,
+ ARIATreeItemContent,
+ ARIATreeRows,
+ ARIARoleAttribute,
+ ARIAOwnsElements,
+ AXColumnCount,
+ AXColumnIndex,
+ AXRowCount,
+ AXRowIndex,
+ AccessKey,
+ AccessibilityButtonState,
+ AccessibilityDescription,
+ AccessibilityText,
+ ActionVerb,
+ AutoCompleteValue,
+ BlockquoteLevel,
+ BoundingBoxRect,
+ CanHaveSelectedChildren,
+ CanSetExpandedAttribute,
+ CanSetFocusAttribute,
+ CanSetNumericValue,
+ CanSetSelectedAttribute,
+ CanSetSelectedChildrenAttribute,
+ CanSetTextRangeAttributes,
+ CanSetValueAttribute,
+ CanvasHasFallbackContent,
+#if PLATFORM(COCOA) && !PLATFORM(IOS_FAMILY)
+ CaretBrowsingEnabled,
+#endif
+ Cells,
+ ClassList,
+ ClickPoint,
+ ColorValue,
+ Columns,
+ ColumnCount,
+ ColumnHeader,
+ ColumnHeaders,
+ ColumnIndex,
+ ColumnIndexRange,
+ ComputedLabel,
+ ComputedRoleString,
+ CurrentState,
+ CurrentValue,
+ DatetimeAttributeValue,
+ DecrementButton,
+ Description,
+ DisclosedByRow,
+ DisclosedRows,
+ DocumentEncoding,
+ DocumentLinks,
+ DocumentURI,
+ EditableAncestor,
+ ElementRect,
+ EstimatedLoadingProgress,
+ ExpandedTextValue,
+ ExposesTitleUIElement,
+ FileUploadButtonReturnsValueInTitle,
+ FocusableAncestor,
+ HasARIAValueNow,
+ HasApplePDFAnnotationAttribute,
+ HasBoldFont,
+ HasChildren,
+ HasHighlighting,
+ HasItalicFont,
+ HasPlainText,
+ HasPopup,
+ HasUnderline,
+ HeaderContainer,
+ HeadingLevel,
+ HelpText,
+ HierarchicalLevel,
+ HighestEditableAncestor,
+ HorizontalScrollBar,
+ IdentifierAttribute,
+ InvalidStatus,
+ IncrementButton,
+ IsAccessibilityIgnored,
+ IsActiveDescendantOfFocusedContainer,
+ IsAnonymousMathOperator,
+ IsGrabbed,
+ IsARIATreeGridRow,
+ IsAttachment,
+ IsButton,
+ IsBusy,
+ IsChecked,
+ IsCollapsed,
+ IsColumnHeaderCell,
+ IsControl,
+ IsDataTable,
+ IsDescriptionList,
+ IsEnabled,
+ IsExpanded,
+ IsExposable,
+ IsFieldset,
+ IsFileUploadButton,
+ IsFocused,
+ IsGroup,
+ IsImageMapLink,
+ IsIncrementor,
+ IsIndeterminate,
+ IsInlineText,
+ IsInputImage,
+ IsInsideLiveRegion,
+ IsHeading,
+ IsHovered,
+ IsKeyboardFocusable,
+ IsLandmark,
+ IsLink,
+ IsLinked,
+ IsList,
+ IsListBox,
+ IsLoaded,
+ IsMathElement,
+ IsMathFraction,
+ IsMathFenced,
+ IsMathSubscriptSuperscript,
+ IsMathRow,
+ IsMathUnderOver,
+ IsMathRoot,
+ IsMathSquareRoot,
+ IsMathText,
+ IsMathNumber,
+ IsMathOperator,
+ IsMathFenceOperator,
+ IsMathSeparatorOperator,
+ IsMathIdentifier,
+ IsMathTable,
+ IsMathTableRow,
+ IsMathTableCell,
+ IsMathMultiscript,
+ IsMathToken,
+ IsMathScriptObject,
+ IsMediaTimeline,
+ IsMenu,
+ IsMenuBar,
+ IsMenuButton,
+ IsMenuItem,
+ IsMenuList,
+ IsMenuListOption,
+ IsMenuListPopup,
+ IsMenuRelated,
+ IsMeter,
+ IsMultiSelectable,
+ IsOrderedList,
+ IsOutput,
+ IsPasswordField,
+ IsPressed,
+ IsProgressIndicator,
+ IsRangeControl,
+ IsRequired,
+ IsRowHeaderCell,
+ IsScrollbar,
+ IsSearchField,
+ IsSelected,
+ IsSelectedOptionActive,
+ IsShowingValidationMessage,
+ IsSlider,
+ IsStyleFormatGroup,
+ IsTable,
+ IsTableCell,
+ IsTableColumn,
+ IsTableRow,
+ IsTextControl,
+ IsTree,
+ IsTreeItem,
+ IsUnorderedList,
+ IsUnvisited,
+ IsValueAutofilled,
+ IsValueAutofillAvailable,
+ IsVisible,
+ IsVisited,
+ KeyShortcutsValue,
+ Language,
+ LayoutCount,
+ LinkRelValue,
+ LinkedUIElements,
+ LiveRegionAtomic,
+ LiveRegionRelevant,
+ LiveRegionStatus,
+ MathFencedOpenString,
+ MathFencedCloseString,
+ MathLineThickness,
+ MathPrescripts,
+ MathPostscripts,
+ MathRadicandObject,
+ MathRootIndexObject,
+ MathUnderObject,
+ MathOverObject,
+ MathNumeratorObject,
+ MathDenominatorObject,
+ MathBaseObject,
+ MathSubscriptObject,
+ MathSuperscriptObject,
+ MaxValueForRange,
+ MinValueForRange,
+ Orientation,
+ Path,
+ PlaceholderValue,
+ PressedIsPresent,
+ PopupValue,
+ PosInSet,
+ PreventKeyboardDOMEventDispatch,
+ ReadOnlyValue,
+ RoleValue,
+ RolePlatformString,
+ RoleDescription,
+ Rows,
+ RowCount,
+ RowHeaders,
+ RowIndex,
+ RowIndexRange,
+ SelectedChildren,
+ SelectedRadioButton,
+ SelectedTabItem,
+ SessionID,
+ SetSize,
+ SortDirection,
+ SpeakAs,
+ SpeechHint,
+ StringValue,
+ SupportsRowCountChange,
+ SupportsDragging,
+ SupportsDropping,
+ SupportsARIAOwns,
+ SupportsCurrent,
+ SupportsDatetimeAttribute,
+ SupportsExpanded,
+ SupportsExpandedTextValue,
+ SupportsLiveRegion,
+ SupportsPath,
+ SupportsPosInSet,
+ SupportsPressAction,
+ SupportsRangeValue,
+ SupportsRequiredAttribute,
+ SupportsSelectedRows,
+ SupportsSetSize,
+ TabChildren,
+ TableLevel,
+ TagName,
+ TextLength,
+ Title,
+ TitleAttributeValue,
+ TitleUIElement,
+ URL,
+ ValueAutofillButtonType,
+ ValueDescription,
+ ValueForRange,
+ ValidationMessage,
+ VerticalScrollBar,
+ VisibleChildren,
+ VisibleRows,
+ WebArea,
+};
+
+typedef std::pair<AXID, AXID> AccessibilityIsolatedTreeMathMultiscriptPair;
+
+struct AccessibilityIsolatedTreeText {
+ String text;
+ AccessibilityTextSource textSource;
+};
+
+using AXPropertyValueVariant = Variant<std::nullptr_t, String, bool, int, unsigned, double, float, uint64_t, Color, URL, LayoutRect, FloatRect, AXID, IntPoint, OptionSet<SpeakAs>, std::pair<unsigned, unsigned>, Vector<AccessibilityIsolatedTreeText>, Vector<AXID>, Vector<AccessibilityIsolatedTreeMathMultiscriptPair>, Vector<String>, Path>;
+typedef HashMap<AXPropertyName, AXPropertyValueVariant, WTF::IntHash<AXPropertyName>, WTF::StrongEnumHashTraits<AXPropertyName>> AXPropertyMap;
+
+struct AXPropertyChange {
+ AXID axID { InvalidAXID }; // ID of the object whose properties changed.
+ AXPropertyMap properties; // Changed properties.
+};
+
class AXIsolatedTree : public ThreadSafeRefCounted<AXIsolatedTree> {
WTF_MAKE_NONCOPYABLE(AXIsolatedTree); WTF_MAKE_FAST_ALLOCATED;
friend WTF::TextStream& operator<<(WTF::TextStream&, AXIsolatedTree&);
@@ -74,6 +351,7 @@
void generateSubtree(AXCoreObject&, AXCoreObject*, bool attachWrapper);
void updateNode(AXCoreObject&);
+ void updateNodeCheckedState(const AXCoreObject&);
void updateSubtree(AXCoreObject&);
void updateChildren(AXCoreObject&);
@@ -119,6 +397,7 @@
// Written to by main thread under lock, accessed and applied by AX thread.
RefPtr<AXIsolatedObject> m_rootNode;
Vector<NodeChange> m_pendingAppends; // Nodes to be added to the tree and platform-wrapped.
+ Vector<AXPropertyChange> m_pendingPropertyChanges;
Vector<AXID> m_pendingNodeRemovals; // Nodes to be removed from the tree.
Vector<AXID> m_pendingSubtreeRemovals; // Nodes whose subtrees are to be removed from the tree.
Vector<std::pair<AXID, Vector<AXID>>> m_pendingChildrenUpdates;
