Title: [170028] trunk/Source/WebCore
- Revision
- 170028
- Author
- [email protected]
- Date
- 2014-06-16 14:44:16 -0700 (Mon, 16 Jun 2014)
Log Message
AX: Safari crashed once in WebCore::AccessibilityObject::ariaIsHidden
https://bugs.webkit.org/show_bug.cgi?id=133825
Reviewed by Enrica Casucci.
Sometimes asking accessibilityIsIgnored() will cause a newObject to be detached immediately after its created.
The creation function holds a reference with RefPtr as long as it lives, but when that method returns, the object goes away.
With that out of the way, I saw the same backtrace lead to updateLayoutIgnorePendingStylesheets being called while still inLayout.
I tried my best but could not create a reproducible layout test.
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::getOrCreate):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::updateBackingStore):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (170027 => 170028)
--- trunk/Source/WebCore/ChangeLog 2014-06-16 21:22:41 UTC (rev 170027)
+++ trunk/Source/WebCore/ChangeLog 2014-06-16 21:44:16 UTC (rev 170028)
@@ -1,3 +1,22 @@
+2014-06-16 Chris Fleizach <[email protected]>
+
+ AX: Safari crashed once in WebCore::AccessibilityObject::ariaIsHidden
+ https://bugs.webkit.org/show_bug.cgi?id=133825
+
+ Reviewed by Enrica Casucci.
+
+ Sometimes asking accessibilityIsIgnored() will cause a newObject to be detached immediately after its created.
+ The creation function holds a reference with RefPtr as long as it lives, but when that method returns, the object goes away.
+
+ With that out of the way, I saw the same backtrace lead to updateLayoutIgnorePendingStylesheets being called while still inLayout.
+
+ I tried my best but could not create a reproducible layout test.
+
+ * accessibility/AXObjectCache.cpp:
+ (WebCore::AXObjectCache::getOrCreate):
+ * accessibility/AccessibilityObject.cpp:
+ (WebCore::AccessibilityObject::updateBackingStore):
+
2014-06-16 Zan Dobersek <[email protected]>
Unreviewed. Add more GStreamer-specific header names that are required
Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (170027 => 170028)
--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2014-06-16 21:22:41 UTC (rev 170027)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2014-06-16 21:44:16 UTC (rev 170028)
@@ -431,7 +431,11 @@
newObj->init();
attachWrapper(newObj.get());
newObj->setLastKnownIsIgnoredValue(newObj->accessibilityIsIgnored());
-
+ // Sometimes asking accessibilityIsIgnored() will cause the newObject to be deallocated, and then
+ // it will disappear when this function is finished, leading to a use-after-free.
+ if (newObj->isDetached())
+ return nullptr;
+
return newObj.get();
}
Modified: trunk/Source/WebCore/accessibility/AccessibilityObject.cpp (170027 => 170028)
--- trunk/Source/WebCore/accessibility/AccessibilityObject.cpp 2014-06-16 21:22:41 UTC (rev 170027)
+++ trunk/Source/WebCore/accessibility/AccessibilityObject.cpp 2014-06-16 21:44:16 UTC (rev 170028)
@@ -1429,8 +1429,10 @@
void AccessibilityObject::updateBackingStore()
{
// Updating the layout may delete this object.
- if (Document* document = this->document())
- document->updateLayoutIgnorePendingStylesheets();
+ if (Document* document = this->document()) {
+ if (!document->view()->isInLayout())
+ document->updateLayoutIgnorePendingStylesheets();
+ }
updateChildrenIfNecessary();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
