Changeset 268830 in webkit

Timestamp:

Oct 21, 2020, 3:15:45 PM (6 years ago)

Author:

Alan Coon

Message:

Cherry-pick r266787. rdar://problem/70541715

AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously.
​https://bugs.webkit.org/show_bug.cgi?id=216309
<rdar://problem/68108824>

Reviewed by Chris Fleizach.

MenuList notifications were posted synchronously which triggers a DOM
layout and style update in the middle of an ongoing DOM mutation update.
This is unnecessary and, furthermore, causes crashes since the DOM
layout update cannot be re-entrant. This change makes these
notifications asynchronous.

• accessibility/AccessibilityMenuList.cpp: (WebCore::AccessibilityMenuList::didUpdateActiveOption):
• accessibility/AccessibilityMenuListPopup.cpp: (WebCore::AccessibilityMenuListPopup::didUpdateActiveOption):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@266787 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-610-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• accessibility/AccessibilityMenuList.cpp (modified) (2 diffs)
• accessibility/AccessibilityMenuListPopup.cpp (modified) (1 diff)

branches/safari-610-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2020-10-21  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r266787. rdar://problem/70541715
+
+    AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously.
+    https://bugs.webkit.org/show_bug.cgi?id=216309
+    <rdar://problem/68108824>
+    
+    Reviewed by Chris Fleizach.
+    
+    MenuList notifications were posted synchronously which triggers a DOM
+    layout and style update in the middle of an ongoing DOM mutation update.
+    This is unnecessary and, furthermore, causes crashes since the DOM
+    layout update cannot be re-entrant. This change makes these
+    notifications asynchronous.
+    
+    * accessibility/AccessibilityMenuList.cpp:
+    (WebCore::AccessibilityMenuList::didUpdateActiveOption):
+    * accessibility/AccessibilityMenuListPopup.cpp:
+    (WebCore::AccessibilityMenuListPopup::didUpdateActiveOption):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@266787 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-09-09  Andres Gonzalez  <andresg_22@apple.com>
+
+            AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously.
+            https://bugs.webkit.org/show_bug.cgi?id=216309
+            <rdar://problem/68108824>
+
+            Reviewed by Chris Fleizach.
+
+            MenuList notifications were posted synchronously which triggers a DOM
+            layout and style update in the middle of an ongoing DOM mutation update.
+            This is unnecessary and, furthermore, causes crashes since the DOM
+            layout update cannot be re-entrant. This change makes these
+            notifications asynchronous.
+
+            * accessibility/AccessibilityMenuList.cpp:
+            (WebCore::AccessibilityMenuList::didUpdateActiveOption):
+            * accessibility/AccessibilityMenuListPopup.cpp:
+            (WebCore::AccessibilityMenuListPopup::didUpdateActiveOption):
+
 2020-10-15  Russell Epstein  <repstein@apple.com>
 

branches/safari-610-branch/Source/WebCore/accessibility/AccessibilityMenuList.cpp

@@ -118 +118 @@
 {
     Ref<Document> document(m_renderer->document());
-    AXObjectCache* cache = document->axObjectCache();
 
     const auto& childObjects = children();
@@ -137 +136 @@
     }
 
-    cache->postNotification(this, document.ptr(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostSynchronously);
+    if (auto* cache = document->axObjectCache())
+        cache->postNotification(this, document.ptr(), AXObjectCache::AXMenuListValueChanged, TargetElement, PostAsynchronously);
 }
 

branches/safari-610-branch/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp

@@ -125 +125 @@
     ASSERT_ARG(optionIndex, optionIndex < static_cast<int>(m_children.size()));
 
-    AXObjectCache* cache = axObjectCache();
     RefPtr<AXCoreObject> child = m_children[optionIndex].get();
 
-    cache->postNotification(child.get(), document(), AXObjectCache::AXFocusedUIElementChanged, TargetElement, PostSynchronously);
-    cache->postNotification(child.get(), document(), AXObjectCache::AXMenuListItemSelected, TargetElement, PostSynchronously);
+    if (auto* cache = axObjectCache()) {
+        cache->postNotification(child.get(), document(), AXObjectCache::AXFocusedUIElementChanged, TargetElement, PostAsynchronously);
+        cache->postNotification(child.get(), document(), AXObjectCache::AXMenuListItemSelected, TargetElement, PostAsynchronously);
+    }
 }