Title: [290308] trunk/Source/WebCore
Revision
290308
Author
[email protected]
Date
2022-02-22 08:08:15 -0800 (Tue, 22 Feb 2022)

Log Message

Fix for crash in several AX LayoutTests in isolated tree mode.
https://bugs.webkit.org/show_bug.cgi?id=237015

Reviewed by Chris Dumez.

Follow up to https://bugs.webkit.org/show_bug.cgi?id=236748.

The iteration over the object's children has to happen over a copy
because the children vector can change during the traversal of the tree.

* accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::collectNodeChangesForSubtree):

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (290307 => 290308)


--- trunk/Source/WebCore/ChangeLog	2022-02-22 16:05:43 UTC (rev 290307)
+++ trunk/Source/WebCore/ChangeLog	2022-02-22 16:08:15 UTC (rev 290308)
@@ -1,3 +1,18 @@
+2022-02-22  Andres Gonzalez  <[email protected]>
+
+        Fix for crash in several AX LayoutTests in isolated tree mode.
+        https://bugs.webkit.org/show_bug.cgi?id=237015
+
+        Reviewed by Chris Dumez.
+
+        Follow up to https://bugs.webkit.org/show_bug.cgi?id=236748.
+
+        The iteration over the object's children has to happen over a copy
+        because the children vector can change during the traversal of the tree.
+
+        * accessibility/isolatedtree/AXIsolatedTree.cpp:
+        (WebCore::AXIsolatedTree::collectNodeChangesForSubtree):
+
 2022-02-22  Tim Nguyen  <[email protected]>
 
         Make pointer-events checks for SVG take in account inert subtrees

Modified: trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp (290307 => 290308)


--- trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp	2022-02-22 16:05:43 UTC (rev 290307)
+++ trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp	2022-02-22 16:08:15 UTC (rev 290308)
@@ -285,7 +285,8 @@
         idsBeingChanged->add(nodeChange.isolatedObject->objectID());
     changes.append(WTFMove(nodeChange));
 
-    auto axChildrenIDs = axObject.children().map([&](auto& axChild) {
+    auto axChildrenCopy = axObject.children();
+    auto axChildrenIDs = axChildrenCopy.map([&](auto& axChild) {
         collectNodeChangesForSubtree(*axChild, axObject.objectID(), attachWrapper, changes, idsBeingChanged);
         return axChild->objectID();
     });
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to