Changeset 255167 in webkit


Ignore:
Timestamp:
Jan 27, 2020, 1:31:01 PM (5 years ago)
Author:
Andres Gonzalez
Message:

Crash in AXIsolatedObject destruction.
​https://bugs.webkit.org/show_bug.cgi?id=206828

Reviewed by Chris Fleizach.

  • The previous AXCoreObject::detach method became detachRemoteParts,

since this method detaches all references to and from other objects.

  • The new AXCoreObject::detach method performs three distinctive

operations:

  1. Detaches the platform wrapper.
  2. Detaches all remote references to and from other objects.
  3. Sets the object ID to InvalidAXID.
  • The detachPlatformWrapper method allows for platform-specific

customizations.

  • Added accessibility/isolatedtree/mac/AXIsolatedobject.mm.
  • PlatformMac.cmake:
  • SourcesCocoa.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::~AXObjectCache):
(WebCore::AXObjectCache::remove):

  • accessibility/AXObjectCache.h:
  • accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::detachRemoteParts):
(WebCore::AccessibilityNodeObject::detach): Became detachRemoteParts.

  • accessibility/AccessibilityNodeObject.h:
  • accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::detachRemoteParts):
(WebCore::AccessibilityObject::detach): Became detachRemoteParts.

  • accessibility/AccessibilityObject.h:
  • accessibility/AccessibilityObjectInterface.h:

(WebCore::AXCoreObject::detachWrapper):
(WebCore::AXCoreObject::detach):

  • accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::detachRemoteParts):
(WebCore::AccessibilityRenderObject::detach): Became detachRemoteParts.

  • accessibility/AccessibilityRenderObject.h:
  • accessibility/AccessibilityScrollView.cpp:

(WebCore::AccessibilityScrollView::detachRemoteParts):
(WebCore::AccessibilityScrollView::detach): Became detachRemoteParts.

  • accessibility/AccessibilityScrollView.h:
  • accessibility/atk/AccessibilityObjectAtk.cpp:

(WebCore::AccessibilityObject::detachPlatformWrapper):

  • accessibility/ios/AXObjectCacheIOS.mm:

(WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.

  • accessibility/ios/AccessibilityObjectIOS.mm:

(WebCore::AccessibilityObject::detachPlatformWrapper):

  • accessibility/isolatedtree/AXIsolatedObject.cpp:

(WebCore::AXIsolatedObject::detachRemoteParts):
(WebCore::AXIsolatedObject::detach): Became detachRemoteParts.
(WebCore::AXIsolatedObject::disconnect): Replaced with AXCoreObject::detach.

  • accessibility/isolatedtree/AXIsolatedObject.h:
  • accessibility/isolatedtree/AXIsolatedTree.cpp:

(WebCore::AXIsolatedTree::removeTreeForPageID):
(WebCore::AXIsolatedTree::applyPendingChanges):

  • accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm:

(WebCore::AXIsolatedObject::detachPlatformWrapper):

  • accessibility/mac/AXObjectCacheMac.mm:

(WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.

  • accessibility/mac/AccessibilityObjectMac.mm:

(WebCore::AccessibilityObject::detachPlatformWrapper):

  • accessibility/win/AccessibilityObjectWin.cpp:

(WebCore::AccessibilityObject::detachPlatformWrapper):

Location:
trunk/Source/WebCore
Files:
1 added
24 edited
1 copied

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r255165 r255167  
     12020-01-27  Andres Gonzalez  <andresg_22@apple.com>
     2
     3        Crash in AXIsolatedObject destruction.
     4        https://bugs.webkit.org/show_bug.cgi?id=206828
     5
     6        Reviewed by Chris Fleizach.
     7
     8        - The previous AXCoreObject::detach method became detachRemoteParts,
     9        since this method detaches all references to and from other objects.
     10        - The new AXCoreObject::detach method performs three distinctive
     11        operations:
     12        1. Detaches the platform wrapper.
     13        2. Detaches all remote references to and from other objects.
     14        3. Sets the object ID to InvalidAXID.
     15        - The detachPlatformWrapper method allows for platform-specific
     16        customizations.
     17        - Added accessibility/isolatedtree/mac/AXIsolatedobject.mm.
     18
     19        * PlatformMac.cmake:
     20        * SourcesCocoa.txt:
     21        * WebCore.xcodeproj/project.pbxproj:
     22        * accessibility/AXObjectCache.cpp:
     23        (WebCore::AXObjectCache::~AXObjectCache):
     24        (WebCore::AXObjectCache::remove):
     25        * accessibility/AXObjectCache.h:
     26        * accessibility/AccessibilityNodeObject.cpp:
     27        (WebCore::AccessibilityNodeObject::detachRemoteParts):
     28        (WebCore::AccessibilityNodeObject::detach): Became detachRemoteParts.
     29        * accessibility/AccessibilityNodeObject.h:
     30        * accessibility/AccessibilityObject.cpp:
     31        (WebCore::AccessibilityObject::detachRemoteParts):
     32        (WebCore::AccessibilityObject::detach): Became detachRemoteParts.
     33        * accessibility/AccessibilityObject.h:
     34        * accessibility/AccessibilityObjectInterface.h:
     35        (WebCore::AXCoreObject::detachWrapper):
     36        (WebCore::AXCoreObject::detach):
     37        * accessibility/AccessibilityRenderObject.cpp:
     38        (WebCore::AccessibilityRenderObject::detachRemoteParts):
     39        (WebCore::AccessibilityRenderObject::detach): Became detachRemoteParts.
     40        * accessibility/AccessibilityRenderObject.h:
     41        * accessibility/AccessibilityScrollView.cpp:
     42        (WebCore::AccessibilityScrollView::detachRemoteParts):
     43        (WebCore::AccessibilityScrollView::detach): Became detachRemoteParts.
     44        * accessibility/AccessibilityScrollView.h:
     45        * accessibility/atk/AccessibilityObjectAtk.cpp:
     46        (WebCore::AccessibilityObject::detachPlatformWrapper):
     47        * accessibility/ios/AXObjectCacheIOS.mm:
     48        (WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.
     49        * accessibility/ios/AccessibilityObjectIOS.mm:
     50        (WebCore::AccessibilityObject::detachPlatformWrapper):
     51        * accessibility/isolatedtree/AXIsolatedObject.cpp:
     52        (WebCore::AXIsolatedObject::detachRemoteParts):
     53        (WebCore::AXIsolatedObject::detach): Became detachRemoteParts.
     54        (WebCore::AXIsolatedObject::disconnect): Replaced with AXCoreObject::detach.
     55        * accessibility/isolatedtree/AXIsolatedObject.h:
     56        * accessibility/isolatedtree/AXIsolatedTree.cpp:
     57        (WebCore::AXIsolatedTree::removeTreeForPageID):
     58        (WebCore::AXIsolatedTree::applyPendingChanges):
     59        * accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm:
     60        (WebCore::AXIsolatedObject::detachPlatformWrapper):
     61        * accessibility/mac/AXObjectCacheMac.mm:
     62        (WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.
     63        * accessibility/mac/AccessibilityObjectMac.mm:
     64        (WebCore::AccessibilityObject::detachPlatformWrapper):
     65        * accessibility/win/AccessibilityObjectWin.cpp:
     66        (WebCore::AccessibilityObject::detachPlatformWrapper):
     67
    1682020-01-27  Ryan Haddad  <ryanhaddad@apple.com>
    269

  • trunk/Source/WebCore/PlatformMac.cmake

    r254878 r255167  
    7878    "${WEBCORE_DIR}/Modules/webauthn/apdu"
    7979    "${WEBCORE_DIR}/Modules/webgpu/WHLSL/Metal"
     80    "${WEBCORE_DIR}/accessibility/isolatedtree/mac"
    8081    "${WEBCORE_DIR}/accessibility/mac"
    8182    "${WEBCORE_DIR}/bridge/objc"
    … …  
    150151    Modules/webaudio/MediaStreamAudioSourceCocoa.cpp
    151152
     153    accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm
    152154    accessibility/mac/AXObjectCacheMac.mm
    153155    accessibility/mac/AccessibilityObjectMac.mm

  • trunk/Source/WebCore/SourcesCocoa.txt

    r254878 r255167  
    3232accessibility/ios/WebAccessibilityObjectWrapperIOS.mm
    3333
     34accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm
    3435accessibility/mac/AXObjectCacheMac.mm
    3536accessibility/mac/AccessibilityObjectBase.mm

  • trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r255158 r255167  
    1352913529                BEF29EEA1715DD0900C4B4C9 /* VideoTrackPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VideoTrackPrivate.h; sourceTree = "<group>"; };
    1353013530                C046E1AB1208A9FE00BA2CF7 /* LocalizedStrings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalizedStrings.cpp; sourceTree = "<group>"; };
     13531                C078376023DF253E00C9C5C8 /* AXIsolatedObjectMac.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; name = AXIsolatedObjectMac.mm; path = mac/AXIsolatedObjectMac.mm; sourceTree = "<group>"; };
    1353113532                C0F2A43F13869A280066C534 /* preprocessor.pm */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; name = preprocessor.pm; path = scripts/preprocessor.pm; sourceTree = "<group>"; };
    1353213533                C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextEncodingDetectorICU.cpp; sourceTree = "<group>"; };
    … …  
    1785117852                        isa = PBXGroup;
    1785217853                        children = (
     17854                                C078375F23DF246200C9C5C8 /* mac */,
    1785317855                                29AE213421ABA48A00869283 /* AXIsolatedObject.cpp */,
    1785417856                                29AE213321ABA48A00869283 /* AXIsolatedObject.h */,
    … …  
    2615026152                        tabWidth = 4;
    2615126153                        usesTabs = 0;
     26154                };
     26155                C078375F23DF246200C9C5C8 /* mac */ = {
     26156                        isa = PBXGroup;
     26157                        children = (
     26158                                C078376023DF253E00C9C5C8 /* AXIsolatedObjectMac.mm */,
     26159                        );
     26160                        name = mac;
     26161                        sourceTree = "<group>";
    2615226162                };
    2615326163                C210E90D21B4BCA400B7F83D /* WHLSL */ = {

  • trunk/Source/WebCore/accessibility/AXObjectCache.cpp

    r255044 r255167  
    240240#endif
    241241
    242     for (const auto& object : m_objects.values()) {
    243         detachWrapper(object.get(), AccessibilityDetachmentType::CacheDestroyed);
     242    for (const auto& object : m_objects.values())
    244243        object->detach(AccessibilityDetachmentType::CacheDestroyed);
    245         object->setObjectID(0);
    246     }
    247244}
    248245
    … …  
    854851        return;
    855852
    856     detachWrapper(object.get(), AccessibilityDetachmentType::ElementDestroyed);
    857     object->detach(AccessibilityDetachmentType::ElementDestroyed, this);
    858     object->setObjectID(0);
     853    object->detach(AccessibilityDetachmentType::ElementDestroyed);
    859854
    860855    m_idsInUse.remove(axID);

  • trunk/Source/WebCore/accessibility/AXObjectCache.h

    r255044 r255167  
    172172    void remove(AXID);
    173173
     174#if !PLATFORM(COCOA)
    174175    void detachWrapper(AXCoreObject*, AccessibilityDetachmentType);
     176#endif
    175177private:
    176178    using DOMObjectVariant = Variant<std::nullptr_t, RenderObject*, Node*, Widget*>;
    … …  
    556558inline void AXObjectCache::deferSelectedChildrenChangedIfNeeded(Element&) { }
    557559inline void AXObjectCache::deferTextReplacementNotificationForTextControl(HTMLTextFormControlElement&, const String&) { }
     560#if !PLATFORM(COCOA)
    558561inline void AXObjectCache::detachWrapper(AXCoreObject*, AccessibilityDetachmentType) { }
     562#endif
    559563inline void AXObjectCache::focusModalNodeTimerFired() { }
    560564inline void AXObjectCache::performCacheUpdateTimerFired() { }

  • trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp

    r254514 r255167  
    107107}
    108108
    109 void AccessibilityNodeObject::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
     109void AccessibilityNodeObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
    110110{
    111111    // AccessibilityObject calls clearChildren.
    112     AccessibilityObject::detach(detachmentType, cache);
     112    AccessibilityObject::detachRemoteParts(detachmentType);
    113113    m_node = nullptr;
    114114}

  • trunk/Source/WebCore/accessibility/AccessibilityNodeObject.h

    r251798 r255167  
    133133    AccessibilityObject* parentObjectIfExists() const override;
    134134
    135     void detach(AccessibilityDetachmentType, AXObjectCache*) override;
    136135    void childrenChanged() override;
    137136    void updateAccessibilityRole() override;
    … …  
    144143protected:
    145144    explicit AccessibilityNodeObject(Node*);
     145    void detachRemoteParts(AccessibilityDetachmentType) override;
    146146
    147147    AccessibilityRole m_ariaRole { AccessibilityRole::Unknown };

  • trunk/Source/WebCore/accessibility/AccessibilityObject.cpp

    r254782 r255167  
    9797}
    9898
    99 void AccessibilityObject::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
     99void AccessibilityObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
    100100{
    101101    // Menu close events need to notify the platform. No element is used in the notification because it's a destruction event.
    102     if (detachmentType == AccessibilityDetachmentType::ElementDestroyed && roleValue() == AccessibilityRole::Menu && cache)
    103         cache->postNotification(nullptr, &cache->document(), AXObjectCache::AXMenuClosed);
    104    
     102    if (detachmentType == AccessibilityDetachmentType::ElementDestroyed && roleValue() == AccessibilityRole::Menu) {
     103        if (auto* cache = axObjectCache())
     104            cache->postNotification(nullptr, &cache->document(), AXObjectCache::AXMenuClosed);
     105    }
     106
    105107    // Clear any children and call detachFromParent on them so that
    106108    // no children are left with dangling pointers to their parent.
    107109    clearChildren();
    108 
    109 #if ENABLE(ACCESSIBILITY)
    110     setWrapper(nullptr);
    111 #endif
    112110}
    113111

  • trunk/Source/WebCore/accessibility/AccessibilityObject.h

    r255080 r255167  
    9797
    9898class AccessibilityObject : public AXCoreObject {
    99 protected:
    100     AccessibilityObject() = default;
    101 
    10299public:
    103100    virtual ~AccessibilityObject();
    … …  
    109106    void init() override { }
    110107
    111     // When the corresponding WebCore object that this AccessibilityObject
    112     // wraps is deleted, it must be detached.
    113     void detach(AccessibilityDetachmentType, AXObjectCache* = nullptr) override;
    114108    bool isDetached() const override;
    115109
    … …  
    737731
    738732protected:
     733    AccessibilityObject() = default;
     734    void detachRemoteParts(AccessibilityDetachmentType) override;
     735    void detachPlatformWrapper(AccessibilityDetachmentType) override;
     736
    739737    AXID m_id { 0 };
    740738    AccessibilityChildrenVector m_children;

  • trunk/Source/WebCore/accessibility/AccessibilityObjectInterface.h

    r255080 r255167  
    478478    // When the corresponding WebCore object that this accessible object
    479479    // represents is deleted, it must be detached.
    480     virtual void detach(AccessibilityDetachmentType, AXObjectCache* = nullptr) = 0;
     480    void detach(AccessibilityDetachmentType);
    481481    virtual bool isDetached() const = 0;
    482482
    … …  
    10791079    AccessibilityObjectWrapper* wrapper() const { return m_wrapper.get(); }
    10801080    void setWrapper(AccessibilityObjectWrapper* wrapper) { m_wrapper = wrapper; }
     1081    void detachWrapper(AccessibilityDetachmentType);
    10811082#else
    10821083    AccessibilityObjectWrapper* wrapper() const { return nullptr; }
    10831084    void setWrapper(AccessibilityObjectWrapper*) { }
     1085    void detachWrapper(AccessibilityDetachmentType) { }
    10841086#endif
    10851087
    … …  
    11301132    virtual String documentURI() const = 0;
    11311133    virtual String documentEncoding() const = 0;
    1132 protected:
     1134private:
     1135    // Detaches this object from the objects it references and it is referenced by.
     1136    virtual void detachRemoteParts(AccessibilityDetachmentType) = 0;
     1137
    11331138#if PLATFORM(COCOA)
    11341139    RetainPtr<WebAccessibilityObjectWrapper> m_wrapper;
    … …  
    11381143    GRefPtr<WebKitAccessible> m_wrapper;
    11391144#endif
    1140 };
     1145    virtual void detachPlatformWrapper(AccessibilityDetachmentType) = 0;
     1146};
     1147
     1148inline void AXCoreObject::detach(AccessibilityDetachmentType detachmentType)
     1149{
     1150    detachWrapper(detachmentType);
     1151    detachRemoteParts(detachmentType);
     1152    setObjectID(InvalidAXID);
     1153}
     1154
     1155inline void AXCoreObject::detachWrapper(AccessibilityDetachmentType detachmentType)
     1156{
     1157    detachPlatformWrapper(detachmentType);
     1158    m_wrapper = nullptr;
     1159}
    11411160
    11421161namespace Accessibility {

  • trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp

    r254557 r255167  
    134134}
    135135
    136 void AccessibilityRenderObject::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
    137 {
    138     AccessibilityNodeObject::detach(detachmentType, cache);
     136void AccessibilityRenderObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
     137{
     138    AccessibilityNodeObject::detachRemoteParts(detachmentType);
    139139   
    140140    detachRemoteSVGRoot();

  • trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h

    r253261 r255167  
    150150    void setSelectedRows(AccessibilityChildrenVector&) override;
    151151    AccessibilityOrientation orientation() const override;
    152    
    153     void detach(AccessibilityDetachmentType, AXObjectCache*) override;
     152
    154153    void textChanged() override;
    155154    void addChildren() override;
    … …  
    204203protected:
    205204    explicit AccessibilityRenderObject(RenderObject*);
     205    void detachRemoteParts(AccessibilityDetachmentType) override;
    206206    ScrollableArea* getScrollableAreaIfScrollable() const override;
    207207    void scrollTo(const IntPoint&) const override;

  • trunk/Source/WebCore/accessibility/AccessibilityScrollView.cpp

    r251798 r255167  
    4949}
    5050
    51 void AccessibilityScrollView::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
    52 {
    53     AccessibilityObject::detach(detachmentType, cache);
     51void AccessibilityScrollView::detachRemoteParts(AccessibilityDetachmentType detachmentType)
     52{
     53    AccessibilityObject::detachRemoteParts(detachmentType);
    5454    m_scrollView = nullptr;
    5555}

  • trunk/Source/WebCore/accessibility/AccessibilityScrollView.h

    r251798 r255167  
    4141
    4242    virtual ~AccessibilityScrollView();
    43     void detach(AccessibilityDetachmentType, AXObjectCache*) override;
    4443
    4544    AccessibilityObject* webAreaObject() const;
    … …  
    4746private:
    4847    explicit AccessibilityScrollView(ScrollView*);
    49    
     48    void detachRemoteParts(AccessibilityDetachmentType) override;
     49
    5050    ScrollableArea* getScrollableAreaIfScrollable() const override;
    5151    void scrollTo(const IntPoint&) const override;

  • trunk/Source/WebCore/accessibility/atk/AccessibilityObjectAtk.cpp

    r247367 r255167  
    2222#include "AccessibilityObject.h"
    2323
     24#include "AXObjectCache.h"
    2425#include "HTMLSpanElement.h"
    2526#include "RenderBlock.h"
    … …  
    3536namespace WebCore {
    3637
     38void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType detachmentType)
     39{
     40    if (auto* cache = axObjectCache())
     41        cache->detachWrapper(this, detachmentType);
     42}
     43
    3744bool AccessibilityObject::accessibilityIgnoreAttachment() const
    3845{

  • trunk/Source/WebCore/accessibility/ios/AXObjectCacheIOS.mm

    r254566 r255167  
    3737namespace WebCore {
    3838   
    39 void AXObjectCache::detachWrapper(AXCoreObject* obj, AccessibilityDetachmentType)
    40 {
    41     [obj->wrapper() detach];
    42     obj->setWrapper(nullptr);
    43 }
    44 
    4539void AXObjectCache::attachWrapper(AXCoreObject* obj)
    4640{

  • trunk/Source/WebCore/accessibility/ios/AccessibilityObjectIOS.mm

    r251798 r255167  
    3838namespace WebCore {
    3939   
     40void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType)
     41{
     42    [wrapper() detach];
     43}
     44
    4045void AccessibilityObject::detachFromParent()
    4146{

  • trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp

    r255095 r255167  
    408408}
    409409
    410 void AXIsolatedObject::detach(AccessibilityDetachmentType, AXObjectCache*)
    411 {
    412     ASSERT(isMainThread());
     410void AXIsolatedObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
     411{
     412    ASSERT(isMainThread() ? detachmentType == AccessibilityDetachmentType::CacheDestroyed : detachmentType != AccessibilityDetachmentType::CacheDestroyed);
    413413    for (const auto& childID : m_childrenIDs)
    414414        tree()->nodeForID(childID)->detachFromParent();
    … …  
    426426{
    427427    m_parent = InvalidAXID;
    428 }
    429 
    430 void AXIsolatedObject::disconnect()
    431 {
    432     ASSERT(isMainThread());
    433     tree()->axObjectCache()->detachWrapper(this, AccessibilityDetachmentType::ElementDestroyed);
    434     detach(AccessibilityDetachmentType::ElementDestroyed);
    435     setObjectID(InvalidAXID);
    436428}
    437429

  • trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h

    r255080 r255167  
    5555    void init() override { }
    5656
    57     void detach(AccessibilityDetachmentType, AXObjectCache* = nullptr) override;
    5857    bool isDetached() const override;
    59     void disconnect();
    6058
    6159    void setTreeIdentifier(AXIsolatedTreeID);
    … …  
    6462
    6563private:
     64    void detachRemoteParts(AccessibilityDetachmentType) override;
     65    void detachPlatformWrapper(AccessibilityDetachmentType) override;
    6666
    6767    AXID parent() const { return m_parent; }

  • trunk/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp

    r254766 r255167  
    9898        for (const auto& axID : tree->m_readerThreadNodeMap.keys()) {
    9999            if (auto object = tree->nodeForID(axID))
    100                 object->disconnect();
     100                object->detach(AccessibilityDetachmentType::CacheDestroyed);
    101101        }
    102102        tree->m_readerThreadNodeMap.clear();
    … …  
    165165    RELEASE_ASSERT(!isMainThread());
    166166    LockHolder locker { m_changeLogLock };
    167     Vector<Ref<AXIsolatedObject>> appendCopy;
    168     std::swap(appendCopy, m_pendingAppends);
    169     Vector<AXID> removeCopy({ WTFMove(m_pendingRemovals) });
    170     locker.unlockEarly();
    171167
    172168    // We don't clear the pending IDs beacause if the next round of updates does not modify them, then they stay the same
    … …  
    174170    m_focusedNodeID = m_pendingFocusedNodeID;
    175171
    176     for (auto& item : appendCopy)
     172    for (auto& item : m_pendingAppends)
    177173        m_readerThreadNodeMap.add(item->objectID(), WTFMove(item));
    178174
    179     for (auto item : removeCopy) {
     175    for (auto& item : m_pendingRemovals) {
    180176        if (auto object = nodeForID(item))
    181             object->disconnect();
     177            object->detach(AccessibilityDetachmentType::ElementDestroyed);
    182178        m_readerThreadNodeMap.remove(item);
    183179    }

  • trunk/Source/WebCore/accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm

    r255166 r255167  
    11/*
    2  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
     2 * Copyright (C) 2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2121 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
    2222 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
    23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
     23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    2424 */
    2525
    26 #include "config.h"
    27 #include "AccessibilityObject.h"
     26#import "config.h"
     27#import "AXIsolatedObject.h"
    2828
    29 #if ENABLE(ACCESSIBILITY)
     29#if ENABLE(ACCESSIBILITY_ISOLATED_TREE) && PLATFORM(MAC)
     30
     31#import "WebAccessibilityObjectWrapperMac.h"
    3032
    3133namespace WebCore {
    3234
    33 bool AccessibilityObject::accessibilityIgnoreAttachment() const
     35void AXIsolatedObject::detachPlatformWrapper(AccessibilityDetachmentType)
    3436{
    35     return false;
     37    [wrapper() detach];
    3638}
    3739
    38 AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
    39 {
    40     if (isMenuListPopup() || isMenuListOption())
    41         return AccessibilityObjectInclusion::IncludeObject;
     40} // WebCore
    4241
    43     return AccessibilityObjectInclusion::DefaultBehavior;
    44 }
    45 
    46 } // namespace WebCore
    47 
    48 #endif // ENABLE(ACCESSIBILITY)
     42#endif // ENABLE(ACCESSIBILITY_ISOLATED_TREE) && PLATFORM(MAC)

  • trunk/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm

    r255044 r255167  
    233233namespace WebCore {
    234234
    235 void AXObjectCache::detachWrapper(AXCoreObject* obj, AccessibilityDetachmentType)
    236 {
    237     [obj->wrapper() detach];
    238     obj->setWrapper(nullptr);
    239 }
    240 
    241235void AXObjectCache::attachWrapper(AXCoreObject* obj)
    242236{

  • trunk/Source/WebCore/accessibility/mac/AccessibilityObjectMac.mm

    r254158 r255167  
    4141
    4242namespace WebCore {
     43
     44void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType)
     45{
     46    [wrapper() detach];
     47}
    4348
    4449void AccessibilityObject::detachFromParent()

  • trunk/Source/WebCore/accessibility/win/AccessibilityObjectWin.cpp

    r247367 r255167  
    2929#if ENABLE(ACCESSIBILITY)
    3030
     31#include "AXObjectCache.h"
     32
    3133namespace WebCore {
     34
     35void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType detachmentType)
     36{
     37    if (auto* cache = axObjectCache())
     38        cache->detachWrapper(this, detachmentType);
     39}
    3240
    3341bool AccessibilityObject::accessibilityIgnoreAttachment() const
Note: See TracChangeset for help on using the changeset viewer.