Title: [266787] trunk/Source/WebCore
Revision
266787
Author
[email protected]
Date
2020-09-09 10:42:00 -0700 (Wed, 09 Sep 2020)

Log Message

AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously.
https://bugs.webkit.org/show_bug.cgi?id=216309
<rdar://problem/68108824>

Reviewed by Chris Fleizach.

MenuList notifications were posted synchronously which triggers a DOM
layout and style update in the middle of an ongoing DOM mutation update.
This is unnecessary and, furthermore, causes crashes since the DOM
layout update cannot be re-entrant. This change makes these
notifications asynchronous.

* accessibility/AccessibilityMenuList.cpp:
(WebCore::AccessibilityMenuList::didUpdateActiveOption):
* accessibility/AccessibilityMenuListPopup.cpp:
(WebCore::AccessibilityMenuListPopup::didUpdateActiveOption):

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (266786 => 266787)


--- trunk/Source/WebCore/ChangeLog	2020-09-09 16:52:24 UTC (rev 266786)
+++ trunk/Source/WebCore/ChangeLog	2020-09-09 17:42:00 UTC (rev 266787)
@@ -1,3 +1,22 @@
+2020-09-09  Andres Gonzalez  <[email protected]>
+
+        AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=216309
+        <rdar://problem/68108824>
+
+        Reviewed by Chris Fleizach.
+
+        MenuList notifications were posted synchronously which triggers a DOM
+        layout and style update in the middle of an ongoing DOM mutation update.
+        This is unnecessary and, furthermore, causes crashes since the DOM
+        layout update cannot be re-entrant. This change makes these
+        notifications asynchronous.
+
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::didUpdateActiveOption):
+        * accessibility/AccessibilityMenuListPopup.cpp:
+        (WebCore::AccessibilityMenuListPopup::didUpdateActiveOption):
+
 2020-09-09  Zalan Bujtas  <[email protected]>
 
         [LFC][IFC] LineBuilder::rebuildLine should just re-initialize the current line

Modified: trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp (266786 => 266787)


--- trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp	2020-09-09 16:52:24 UTC (rev 266786)
+++ trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp	2020-09-09 17:42:00 UTC (rev 266787)
@@ -117,7 +117,6 @@
 void AccessibilityMenuList::didUpdateActiveOption(int optionIndex)
 {
     Ref<Document> document(m_renderer->document());
-    AXObjectCache* cache = document->axObjectCache();
 
     const auto& childObjects = children();
     if (!childObjects.isEmpty()) {
@@ -136,7 +135,8 @@
             downcast<AccessibilityMenuListPopup>(*childObjects[0]).didUpdateActiveOption(optionIndex);
     }
 
-    cache->postNotification(this, document.ptr(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostSynchronously);
+    if (auto* cache = document->axObjectCache())
+        cache->postNotification(this, document.ptr(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostAsynchronously);
 }
 
 } // namespace WebCore

Modified: trunk/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp (266786 => 266787)


--- trunk/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp	2020-09-09 16:52:24 UTC (rev 266786)
+++ trunk/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp	2020-09-09 17:42:00 UTC (rev 266787)
@@ -124,11 +124,12 @@
     ASSERT_ARG(optionIndex, optionIndex >= 0);
     ASSERT_ARG(optionIndex, optionIndex < static_cast<int>(m_children.size()));
 
-    AXObjectCache* cache = axObjectCache();
     RefPtr<AXCoreObject> child = m_children[optionIndex].get();
 
-    cache->postNotification(child.get(), document(), AXObjectCache::AXFocusedUIElementChanged, TargetElement, PostSynchronously);
-    cache->postNotification(child.get(), document(), AXObjectCache::AXMenuListItemSelected, TargetElement, PostSynchronously);
+    if (auto* cache = axObjectCache()) {
+        cache->postNotification(child.get(), document(), AXObjectCache::AXFocusedUIElementChanged, TargetElement, PostAsynchronously);
+        cache->postNotification(child.get(), document(), AXObjectCache::AXMenuListItemSelected, TargetElement, PostAsynchronously);
+    }
 }
 
 } // namespace WebCore
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to