Changeset 266787 in webkit

Timestamp:

Sep 9, 2020, 10:42:00 AM (6 years ago)

Author:

Andres Gonzalez

Message:

AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously.
​https://bugs.webkit.org/show_bug.cgi?id=216309
<rdar://problem/68108824>

Reviewed by Chris Fleizach.

MenuList notifications were posted synchronously which triggers a DOM
layout and style update in the middle of an ongoing DOM mutation update.
This is unnecessary and, furthermore, causes crashes since the DOM
layout update cannot be re-entrant. This change makes these
notifications asynchronous.

• accessibility/AccessibilityMenuList.cpp:

(WebCore::AccessibilityMenuList::didUpdateActiveOption):

• accessibility/AccessibilityMenuListPopup.cpp:

(WebCore::AccessibilityMenuListPopup::didUpdateActiveOption):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• accessibility/AccessibilityMenuList.cpp (modified) (2 diffs)
• accessibility/AccessibilityMenuListPopup.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-09-09  Andres Gonzalez  <andresg_22@apple.com>
+
+        AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=216309
+        <rdar://problem/68108824>
+
+        Reviewed by Chris Fleizach.
+
+        MenuList notifications were posted synchronously which triggers a DOM
+        layout and style update in the middle of an ongoing DOM mutation update.
+        This is unnecessary and, furthermore, causes crashes since the DOM
+        layout update cannot be re-entrant. This change makes these
+        notifications asynchronous.
+
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::didUpdateActiveOption):
+        * accessibility/AccessibilityMenuListPopup.cpp:
+        (WebCore::AccessibilityMenuListPopup::didUpdateActiveOption):
+
 2020-09-09  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/accessibility/AccessibilityMenuList.cpp

@@ -118 +118 @@
 {
     Ref<Document> document(m_renderer->document());
-    AXObjectCache* cache = document->axObjectCache();
 
     const auto& childObjects = children();
@@ -137 +136 @@
     }
 
-    cache->postNotification(this, document.ptr(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostSynchronously);
+    if (auto* cache = document->axObjectCache())
+        cache->postNotification(this, document.ptr(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostAsynchronously);
 }
 

trunk/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp

@@ -125 +125 @@
     ASSERT_ARG(optionIndex, optionIndex < static_cast<int>(m_children.size()));
 
-    AXObjectCache* cache = axObjectCache();
     RefPtr<AXCoreObject> child = m_children[optionIndex].get();
 
-    cache->postNotification(child.get(), document(), AXObjectCache::AXFocusedUIElementChanged, TargetElement, PostSynchronously);
-    cache->postNotification(child.get(), document(), AXObjectCache::AXMenuListItemSelected, TargetElement, PostSynchronously);
+    if (auto* cache = axObjectCache()) {
+        cache->postNotification(child.get(), document(), AXObjectCache::AXFocusedUIElementChanged, TargetElement, PostAsynchronously);
+        cache->postNotification(child.get(), document(), AXObjectCache::AXMenuListItemSelected, TargetElement, PostAsynchronously);
+    }
 }