Changeset 241495 in webkit

Timestamp:

Feb 13, 2019 7:38:40 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Web Inspector: Crash when inspecting an element that constantly changes visibility
​https://bugs.webkit.org/show_bug.cgi?id=194632
<rdar://problem/48060258>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2019-02-13
Reviewed by Matt Baker and Devin Rousso.

• inspector/agents/InspectorDOMAgent.h:
• inspector/agents/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::processAccessibilityChildren):
(WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
Don't use rvalue-references as that was taking ownership and deleting
the object we want to keep around. Instead simplify this to just use
references so no ref counting changes happen.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• inspector/agents/InspectorDOMAgent.cpp (modified) (2 diffs)
• inspector/agents/InspectorDOMAgent.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-02-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Crash when inspecting an element that constantly changes visibility
+        https://bugs.webkit.org/show_bug.cgi?id=194632
+        <rdar://problem/48060258>
+
+        Reviewed by Matt Baker and Devin Rousso.
+
+        * inspector/agents/InspectorDOMAgent.h:
+        * inspector/agents/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::processAccessibilityChildren):
+        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
+        Don't use rvalue-references as that was taking ownership and deleting
+        the object we want to keep around. Instead simplify this to just use
+        references so no ref counting changes happen.
+
 2019-02-13  Chris Fleizach  <cfleizach@apple.com>
 

trunk/Source/WebCore/inspector/agents/InspectorDOMAgent.cpp

@@ -1743 +1743 @@
     return value;
 }
-    
-void InspectorDOMAgent::processAccessibilityChildren(RefPtr<AccessibilityObject>&& axObject, RefPtr<JSON::ArrayOf<int>>&& childNodeIds)
-{
-    const auto& children = axObject->children();
+
+void InspectorDOMAgent::processAccessibilityChildren(AccessibilityObject& axObject, JSON::ArrayOf<int>& childNodeIds)
+{
+    const auto& children = axObject.children();
     if (!children.size())
         return;
-    
-    if (!childNodeIds)
-        childNodeIds = JSON::ArrayOf<int>::create();
-    
+
     for (const auto& childObject : children) {
         if (Node* childNode = childObject->node())
-            childNodeIds->addItem(pushNodePathToFrontend(childNode));
+            childNodeIds.addItem(pushNodePathToFrontend(childNode));
         else
-            processAccessibilityChildren(childObject.copyRef(), childNodeIds.copyRef());
+            processAccessibilityChildren(*childObject, childNodeIds);
     }
 }
@@ -1833 +1830 @@
             }
             
-            processAccessibilityChildren(axObject, WTFMove(childNodeIds));
+            if (!axObject->children().isEmpty()) {
+                childNodeIds = JSON::ArrayOf<int>::create();
+                processAccessibilityChildren(*axObject, *childNodeIds);
+            }
             
             Vector<Element*> controlledElements;

trunk/Source/WebCore/inspector/agents/InspectorDOMAgent.h

@@ -249 +249 @@
     Ref<Inspector::Protocol::DOM::EventListener> buildObjectForEventListener(const RegisteredEventListener&, int identifier, const AtomicString& eventType, Node*, const String* objectGroupId, bool disabled, bool hasBreakpoint);
     RefPtr<Inspector::Protocol::DOM::AccessibilityProperties> buildObjectForAccessibilityProperties(Node*);
-    void processAccessibilityChildren(RefPtr<AccessibilityObject>&&, RefPtr<JSON::ArrayOf<int>>&&);
+    void processAccessibilityChildren(AccessibilityObject&, JSON::ArrayOf<int>&);
     
     Node* nodeForPath(const String& path);