Title: [286780] trunk/Source/WebCore
Revision
286780
Author
[email protected]
Date
2021-12-09 07:40:58 -0800 (Thu, 09 Dec 2021)

Log Message

AX: Use RefPtr<AXCoreObject> instead of raw AXCoreObject* pointers in Accessibility::findMatchingObjects and downstream functions
https://bugs.webkit.org/show_bug.cgi?id=233888

Reviewed by Chris Fleizach.

Move usages of raw AXCoreObject* pointers to RefPtr<AXCoreObject> in
Accessibility::findMatchingObjects and downstream functions.

This fixes isolated tree mode only crashes for tests:
  - accessibility/mac/search-predicate-element-count.html
  - accessibility/mac/search-predicate-visible-button.html

These crashed because:

  1. The secondary thread starts a search and stores raw pointers on
     its stack.
  2. The main thread performs some operation to queue isolated tree
     changes.
  3. The search continues on the secondary thread, eventually calling
     AXIsolatedObject::children. This in turns calls AXIsolatedTree::pendingChanges.
  4. The object(s) which we held pointers to are destroyed.

* accessibility/AccessibilityObject.cpp:
(WebCore::appendAccessibilityObject):
(WebCore::Accessibility::isRadioButtonInDifferentAdhocGroup):
(WebCore::Accessibility::isAccessibilityObjectSearchMatchAtIndex):
(WebCore::Accessibility::isAccessibilityObjectSearchMatch):
(WebCore::Accessibility::isAccessibilityTextSearchMatch):
(WebCore::Accessibility::objectMatchesSearchCriteriaWithResultLimit):
(WebCore::Accessibility::appendChildrenToArray):
(WebCore::Accessibility::findMatchingObjects):
Use RefPtr<AXCoreObject> instead of raw AXCoreObject* pointers.

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (286779 => 286780)


--- trunk/Source/WebCore/ChangeLog	2021-12-09 15:33:03 UTC (rev 286779)
+++ trunk/Source/WebCore/ChangeLog	2021-12-09 15:40:58 UTC (rev 286780)
@@ -1,3 +1,38 @@
+2021-12-09  Tyler Wilcock  <[email protected]>
+
+        AX: Use RefPtr<AXCoreObject> instead of raw AXCoreObject* pointers in Accessibility::findMatchingObjects and downstream functions
+        https://bugs.webkit.org/show_bug.cgi?id=233888
+
+        Reviewed by Chris Fleizach.
+
+        Move usages of raw AXCoreObject* pointers to RefPtr<AXCoreObject> in
+        Accessibility::findMatchingObjects and downstream functions.
+
+        This fixes isolated tree mode only crashes for tests:
+          - accessibility/mac/search-predicate-element-count.html
+          - accessibility/mac/search-predicate-visible-button.html
+
+        These crashed because:
+
+          1. The secondary thread starts a search and stores raw pointers on
+             its stack.
+          2. The main thread performs some operation to queue isolated tree
+             changes.
+          3. The search continues on the secondary thread, eventually calling
+             AXIsolatedObject::children. This in turns calls AXIsolatedTree::pendingChanges.
+          4. The object(s) which we held pointers to are destroyed.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::appendAccessibilityObject):
+        (WebCore::Accessibility::isRadioButtonInDifferentAdhocGroup):
+        (WebCore::Accessibility::isAccessibilityObjectSearchMatchAtIndex):
+        (WebCore::Accessibility::isAccessibilityObjectSearchMatch):
+        (WebCore::Accessibility::isAccessibilityTextSearchMatch):
+        (WebCore::Accessibility::objectMatchesSearchCriteriaWithResultLimit):
+        (WebCore::Accessibility::appendChildrenToArray):
+        (WebCore::Accessibility::findMatchingObjects):
+        Use RefPtr<AXCoreObject> instead of raw AXCoreObject* pointers.
+
 2021-12-09  Manuel Rego Casasnovas  <[email protected]>
 
         [selectors] Match :focus-visible on <select> elements

Modified: trunk/Source/WebCore/accessibility/AccessibilityObject.cpp (286779 => 286780)


--- trunk/Source/WebCore/accessibility/AccessibilityObject.cpp	2021-12-09 15:33:03 UTC (rev 286779)
+++ trunk/Source/WebCore/accessibility/AccessibilityObject.cpp	2021-12-09 15:40:58 UTC (rev 286780)
@@ -533,7 +533,7 @@
     }) != nullptr;
 }
 
-static void appendAccessibilityObject(AXCoreObject* object, AccessibilityObject::AccessibilityChildrenVector& results)
+static void appendAccessibilityObject(RefPtr<AXCoreObject> object, AccessibilityObject::AccessibilityChildrenVector& results)
 {
     // Find the next descendant of this attachment object so search can continue through frames.
     if (object->isAttachment()) {
@@ -3907,7 +3907,7 @@
 
 // This function determines if the given `axObject` is a radio button part of a different ad-hoc radio group
 // than `referenceObject`, where ad-hoc radio group membership is determined by comparing `name` attributes.
-static bool isRadioButtonInDifferentAdhocGroup(AXCoreObject* axObject, AXCoreObject* referenceObject)
+static bool isRadioButtonInDifferentAdhocGroup(RefPtr<AXCoreObject> axObject, AXCoreObject* referenceObject)
 {
     if (!axObject || !axObject->isRadioButton())
         return false;
@@ -3920,7 +3920,7 @@
     return axObject->attributeValue("name") != referenceObject->attributeValue("name");
 }
 
-static bool isAccessibilityObjectSearchMatchAtIndex(AXCoreObject* axObject, AccessibilitySearchCriteria const& criteria, size_t index)
+static bool isAccessibilityObjectSearchMatchAtIndex(RefPtr<AXCoreObject> axObject, AccessibilitySearchCriteria const& criteria, size_t index)
 {
     switch (criteria.searchKeys[index]) {
     case AccessibilitySearchKey::AnyType:
@@ -4028,7 +4028,7 @@
     }
 }
 
-static bool isAccessibilityObjectSearchMatch(AXCoreObject* axObject, AccessibilitySearchCriteria const& criteria)
+static bool isAccessibilityObjectSearchMatch(RefPtr<AXCoreObject> axObject, AccessibilitySearchCriteria const& criteria)
 {
     if (!axObject)
         return false;
@@ -4044,7 +4044,7 @@
     return false;
 }
 
-static bool isAccessibilityTextSearchMatch(AXCoreObject* axObject, AccessibilitySearchCriteria const& criteria)
+static bool isAccessibilityTextSearchMatch(RefPtr<AXCoreObject> axObject, AccessibilitySearchCriteria const& criteria)
 {
     if (!axObject)
         return false;
@@ -4058,7 +4058,7 @@
         || containsPlainText(axObject->stringValue(), criteria.searchText, CaseInsensitive);
 }
 
-static bool objectMatchesSearchCriteriaWithResultLimit(AXCoreObject* object, AccessibilitySearchCriteria const& criteria, AXCoreObject::AccessibilityChildrenVector& results)
+static bool objectMatchesSearchCriteriaWithResultLimit(RefPtr<AXCoreObject> object, AccessibilitySearchCriteria const& criteria, AXCoreObject::AccessibilityChildrenVector& results)
 {
     if (isAccessibilityObjectSearchMatch(object, criteria) && isAccessibilityTextSearchMatch(object, criteria)) {
         results.append(object);
@@ -4071,7 +4071,7 @@
     return false;
 }
 
-static void appendChildrenToArray(AXCoreObject* object, bool isForward, AXCoreObject* startObject, AccessibilityObject::AccessibilityChildrenVector& results)
+static void appendChildrenToArray(RefPtr<AXCoreObject> object, bool isForward, RefPtr<AXCoreObject> startObject, AccessibilityObject::AccessibilityChildrenVector& results)
 {
     // A table's children includes elements whose own children are also the table's children (due to the way the Mac exposes tables).
     // The rows from the table should be queried, since those are direct descendants of the table, and they contain content.
@@ -4083,8 +4083,8 @@
     size_t endIndex = isForward ? 0 : childrenSize;
 
     // If the startObject is ignored, we should use an accessible sibling as a start element instead.
-    if (startObject && startObject->accessibilityIsIgnored() && startObject->isDescendantOfObject(object)) {
-        AXCoreObject* parentObject = startObject->parentObject();
+    if (startObject && startObject->accessibilityIsIgnored() && startObject->isDescendantOfObject(object.get())) {
+        RefPtr<AXCoreObject> parentObject = startObject->parentObject();
         // Go up the parent chain to find the highest ancestor that's also being ignored.
         while (parentObject && parentObject->accessibilityIsIgnored()) {
             if (parentObject == object)
@@ -4109,10 +4109,10 @@
     // This is broken into two statements so that it's easier read.
     if (isForward) {
         for (size_t i = startIndex; i > endIndex; i--)
-            appendAccessibilityObject(searchChildren.at(i - 1).get(), results);
+            appendAccessibilityObject(searchChildren.at(i - 1), results);
     } else {
         for (size_t i = startIndex; i < endIndex; i++)
-            appendAccessibilityObject(searchChildren.at(i).get(), results);
+            appendAccessibilityObject(searchChildren.at(i), results);
     }
 }
 
@@ -4125,7 +4125,7 @@
     // It does this by stepping up the parent chain and at each level doing a DFS.
 
     // If there's no start object, it means we want to search everything.
-    AXCoreObject* startObject = criteria.startObject;
+    RefPtr<AXCoreObject> startObject = criteria.startObject;
     if (!startObject)
         startObject = criteria.anchorObject;
 
@@ -4134,7 +4134,7 @@
     // The first iteration of the outer loop will examine the children of the start object for matches. However, when
     // iterating backwards, the start object children should not be considered, so the loop is skipped ahead. We make an
     // exception when no start object was specified because we want to search everything regardless of search direction.
-    AXCoreObject* previousObject = nullptr;
+    RefPtr<AXCoreObject> previousObject;
     if (!isForward && startObject != criteria.anchorObject) {
         previousObject = startObject;
         startObject = startObject->parentObjectUnignored();
@@ -4150,7 +4150,7 @@
 
         // This now does a DFS at the current level of the parent.
         while (!searchStack.isEmpty()) {
-            AXCoreObject* searchObject = searchStack.last().get();
+            auto searchObject = searchStack.last();
             searchStack.removeLast();
 
             if (objectMatchesSearchCriteriaWithResultLimit(searchObject, criteria, results))

Modified: trunk/Source/WebCore/accessibility/AccessibilityObjectInterface.h (286779 => 286780)


--- trunk/Source/WebCore/accessibility/AccessibilityObjectInterface.h	2021-12-09 15:33:03 UTC (rev 286779)
+++ trunk/Source/WebCore/accessibility/AccessibilityObjectInterface.h	2021-12-09 15:40:58 UTC (rev 286780)
@@ -1682,8 +1682,8 @@
 inline bool AXCoreObject::isDescendantOfObject(const AXCoreObject* axObject) const
 {
     return axObject && Accessibility::findAncestor<AXCoreObject>(*this, false, [axObject] (const AXCoreObject& object) {
-            return &object == axObject;
-        }) != nullptr;
+        return &object == axObject;
+    }) != nullptr;
 }
 
 inline bool AXCoreObject::isAncestorOfObject(const AXCoreObject* axObject) const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to