Crash in AXIsolatedObject destruction.
authorandresg_22@apple.com <andresg_22@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 27 Jan 2020 21:31:01 +0000 (21:31 +0000)
committerandresg_22@apple.com <andresg_22@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 27 Jan 2020 21:31:01 +0000 (21:31 +0000)
https://bugs.webkit.org/show_bug.cgi?id=206828

Reviewed by Chris Fleizach.

- The previous AXCoreObject::detach method became detachRemoteParts,
since this method detaches all references to and from other objects.
- The new AXCoreObject::detach method performs three distinctive
operations:
1. Detaches the platform wrapper.
2. Detaches all remote references to and from other objects.
3. Sets the object ID to InvalidAXID.
- The detachPlatformWrapper method allows for platform-specific
customizations.
- Added accessibility/isolatedtree/mac/AXIsolatedobject.mm.

* PlatformMac.cmake:
* SourcesCocoa.txt:
* WebCore.xcodeproj/project.pbxproj:
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::~AXObjectCache):
(WebCore::AXObjectCache::remove):
* accessibility/AXObjectCache.h:
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::detachRemoteParts):
(WebCore::AccessibilityNodeObject::detach): Became detachRemoteParts.
* accessibility/AccessibilityNodeObject.h:
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::detachRemoteParts):
(WebCore::AccessibilityObject::detach): Became detachRemoteParts.
* accessibility/AccessibilityObject.h:
* accessibility/AccessibilityObjectInterface.h:
(WebCore::AXCoreObject::detachWrapper):
(WebCore::AXCoreObject::detach):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::detachRemoteParts):
(WebCore::AccessibilityRenderObject::detach): Became detachRemoteParts.
* accessibility/AccessibilityRenderObject.h:
* accessibility/AccessibilityScrollView.cpp:
(WebCore::AccessibilityScrollView::detachRemoteParts):
(WebCore::AccessibilityScrollView::detach): Became detachRemoteParts.
* accessibility/AccessibilityScrollView.h:
* accessibility/atk/AccessibilityObjectAtk.cpp:
(WebCore::AccessibilityObject::detachPlatformWrapper):
* accessibility/ios/AXObjectCacheIOS.mm:
(WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.
* accessibility/ios/AccessibilityObjectIOS.mm:
(WebCore::AccessibilityObject::detachPlatformWrapper):
* accessibility/isolatedtree/AXIsolatedObject.cpp:
(WebCore::AXIsolatedObject::detachRemoteParts):
(WebCore::AXIsolatedObject::detach): Became detachRemoteParts.
(WebCore::AXIsolatedObject::disconnect): Replaced with AXCoreObject::detach.
* accessibility/isolatedtree/AXIsolatedObject.h:
* accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::removeTreeForPageID):
(WebCore::AXIsolatedTree::applyPendingChanges):
* accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm:
(WebCore::AXIsolatedObject::detachPlatformWrapper):
* accessibility/mac/AXObjectCacheMac.mm:
(WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.
* accessibility/mac/AccessibilityObjectMac.mm:
(WebCore::AccessibilityObject::detachPlatformWrapper):
* accessibility/win/AccessibilityObjectWin.cpp:
(WebCore::AccessibilityObject::detachPlatformWrapper):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@255167 268f45cc-cd09-0410-ab3c-d52691b4dbfc

25 files changed:
Source/WebCore/ChangeLog
Source/WebCore/PlatformMac.cmake
Source/WebCore/SourcesCocoa.txt
Source/WebCore/WebCore.xcodeproj/project.pbxproj
Source/WebCore/accessibility/AXObjectCache.cpp
Source/WebCore/accessibility/AXObjectCache.h
Source/WebCore/accessibility/AccessibilityNodeObject.cpp
Source/WebCore/accessibility/AccessibilityNodeObject.h
Source/WebCore/accessibility/AccessibilityObject.cpp
Source/WebCore/accessibility/AccessibilityObject.h
Source/WebCore/accessibility/AccessibilityObjectInterface.h
Source/WebCore/accessibility/AccessibilityRenderObject.cpp
Source/WebCore/accessibility/AccessibilityRenderObject.h
Source/WebCore/accessibility/AccessibilityScrollView.cpp
Source/WebCore/accessibility/AccessibilityScrollView.h
Source/WebCore/accessibility/atk/AccessibilityObjectAtk.cpp
Source/WebCore/accessibility/ios/AXObjectCacheIOS.mm
Source/WebCore/accessibility/ios/AccessibilityObjectIOS.mm
Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h
Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
Source/WebCore/accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm [new file with mode: 0644]
Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
Source/WebCore/accessibility/mac/AccessibilityObjectMac.mm
Source/WebCore/accessibility/win/AccessibilityObjectWin.cpp

index 4f83078..fd3f693 100644 (file)
@@ -1,3 +1,70 @@
+2020-01-27  Andres Gonzalez  <andresg_22@apple.com>
+
+        Crash in AXIsolatedObject destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=206828
+
+        Reviewed by Chris Fleizach.
+
+        - The previous AXCoreObject::detach method became detachRemoteParts,
+        since this method detaches all references to and from other objects.
+        - The new AXCoreObject::detach method performs three distinctive
+        operations:
+        1. Detaches the platform wrapper.
+        2. Detaches all remote references to and from other objects.
+        3. Sets the object ID to InvalidAXID.
+        - The detachPlatformWrapper method allows for platform-specific
+        customizations.
+        - Added accessibility/isolatedtree/mac/AXIsolatedobject.mm.
+
+        * PlatformMac.cmake:
+        * SourcesCocoa.txt:
+        * WebCore.xcodeproj/project.pbxproj:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::~AXObjectCache):
+        (WebCore::AXObjectCache::remove):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::detachRemoteParts):
+        (WebCore::AccessibilityNodeObject::detach): Became detachRemoteParts.
+        * accessibility/AccessibilityNodeObject.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::detachRemoteParts):
+        (WebCore::AccessibilityObject::detach): Became detachRemoteParts.
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityObjectInterface.h:
+        (WebCore::AXCoreObject::detachWrapper):
+        (WebCore::AXCoreObject::detach):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::detachRemoteParts):
+        (WebCore::AccessibilityRenderObject::detach): Became detachRemoteParts.
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityScrollView.cpp:
+        (WebCore::AccessibilityScrollView::detachRemoteParts):
+        (WebCore::AccessibilityScrollView::detach): Became detachRemoteParts.
+        * accessibility/AccessibilityScrollView.h:
+        * accessibility/atk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::detachPlatformWrapper):
+        * accessibility/ios/AXObjectCacheIOS.mm:
+        (WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.
+        * accessibility/ios/AccessibilityObjectIOS.mm:
+        (WebCore::AccessibilityObject::detachPlatformWrapper):
+        * accessibility/isolatedtree/AXIsolatedObject.cpp:
+        (WebCore::AXIsolatedObject::detachRemoteParts):
+        (WebCore::AXIsolatedObject::detach): Became detachRemoteParts.
+        (WebCore::AXIsolatedObject::disconnect): Replaced with AXCoreObject::detach.
+        * accessibility/isolatedtree/AXIsolatedObject.h:
+        * accessibility/isolatedtree/AXIsolatedTree.cpp:
+        (WebCore::AXIsolatedTree::removeTreeForPageID):
+        (WebCore::AXIsolatedTree::applyPendingChanges):
+        * accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm:
+        (WebCore::AXIsolatedObject::detachPlatformWrapper):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::detachWrapper): Deleted, no longer used in COCOA platforms.
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::detachPlatformWrapper):
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::detachPlatformWrapper):
+
 2020-01-27  Ryan Haddad  <ryanhaddad@apple.com>
 
         Unreviewed, rolling out r255161.
index 993355d..aec3206 100644 (file)
@@ -77,6 +77,7 @@ list(APPEND WebCore_PRIVATE_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/Modules/remoteplayback"
     "${WEBCORE_DIR}/Modules/webauthn/apdu"
     "${WEBCORE_DIR}/Modules/webgpu/WHLSL/Metal"
+    "${WEBCORE_DIR}/accessibility/isolatedtree/mac"
     "${WEBCORE_DIR}/accessibility/mac"
     "${WEBCORE_DIR}/bridge/objc"
     "${WEBCORE_DIR}/crypto/mac"
@@ -149,6 +150,7 @@ list(APPEND WebCore_SOURCES
 
     Modules/webaudio/MediaStreamAudioSourceCocoa.cpp
 
+    accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm
     accessibility/mac/AXObjectCacheMac.mm
     accessibility/mac/AccessibilityObjectMac.mm
     accessibility/mac/WebAccessibilityObjectWrapperMac.mm
index 106740d..4de75df 100644 (file)
@@ -31,6 +31,7 @@ accessibility/ios/AccessibilityObjectIOS.mm
 accessibility/ios/AXObjectCacheIOS.mm
 accessibility/ios/WebAccessibilityObjectWrapperIOS.mm
 
+accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm
 accessibility/mac/AXObjectCacheMac.mm
 accessibility/mac/AccessibilityObjectBase.mm
 accessibility/mac/AccessibilityObjectMac.mm
index 311e762..90d51be 100644 (file)
                BEF29EE91715DD0900C4B4C9 /* AudioTrackPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AudioTrackPrivate.h; sourceTree = "<group>"; };
                BEF29EEA1715DD0900C4B4C9 /* VideoTrackPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VideoTrackPrivate.h; sourceTree = "<group>"; };
                C046E1AB1208A9FE00BA2CF7 /* LocalizedStrings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalizedStrings.cpp; sourceTree = "<group>"; };
+               C078376023DF253E00C9C5C8 /* AXIsolatedObjectMac.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; name = AXIsolatedObjectMac.mm; path = mac/AXIsolatedObjectMac.mm; sourceTree = "<group>"; };
                C0F2A43F13869A280066C534 /* preprocessor.pm */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; name = preprocessor.pm; path = scripts/preprocessor.pm; sourceTree = "<group>"; };
                C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextEncodingDetectorICU.cpp; sourceTree = "<group>"; };
                C105DA630F3AA6B8001DD44F /* TextEncodingDetector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextEncodingDetector.h; sourceTree = "<group>"; };
                29AE212921AB9ECB00869283 /* isolatedtree */ = {
                        isa = PBXGroup;
                        children = (
+                               C078375F23DF246200C9C5C8 /* mac */,
                                29AE213421ABA48A00869283 /* AXIsolatedObject.cpp */,
                                29AE213321ABA48A00869283 /* AXIsolatedObject.h */,
                                29AE212C21AB9EEB00869283 /* AXIsolatedTree.cpp */,
                        tabWidth = 4;
                        usesTabs = 0;
                };
+               C078375F23DF246200C9C5C8 /* mac */ = {
+                       isa = PBXGroup;
+                       children = (
+                               C078376023DF253E00C9C5C8 /* AXIsolatedObjectMac.mm */,
+                       );
+                       name = mac;
+                       sourceTree = "<group>";
+               };
                C210E90D21B4BCA400B7F83D /* WHLSL */ = {
                        isa = PBXGroup;
                        children = (
index c746bc1..37dddc6 100644 (file)
@@ -239,11 +239,8 @@ AXObjectCache::~AXObjectCache()
         AXIsolatedTree::removeTreeForPageID(*m_pageID);
 #endif
 
-    for (const auto& object : m_objects.values()) {
-        detachWrapper(object.get(), AccessibilityDetachmentType::CacheDestroyed);
+    for (const auto& object : m_objects.values())
         object->detach(AccessibilityDetachmentType::CacheDestroyed);
-        object->setObjectID(0);
-    }
 }
 
 void AXObjectCache::findModalNodes()
@@ -853,9 +850,7 @@ void AXObjectCache::remove(AXID axID)
     if (!object)
         return;
 
-    detachWrapper(object.get(), AccessibilityDetachmentType::ElementDestroyed);
-    object->detach(AccessibilityDetachmentType::ElementDestroyed, this);
-    object->setObjectID(0);
+    object->detach(AccessibilityDetachmentType::ElementDestroyed);
 
     m_idsInUse.remove(axID);
     ASSERT(m_objects.size() >= m_idsInUse.size());
index 2139406..590de52 100644 (file)
@@ -171,7 +171,9 @@ public:
     void remove(Widget*);
     void remove(AXID);
 
+#if !PLATFORM(COCOA)
     void detachWrapper(AXCoreObject*, AccessibilityDetachmentType);
+#endif
 private:
     using DOMObjectVariant = Variant<std::nullptr_t, RenderObject*, Node*, Widget*>;
     void cacheAndInitializeWrapper(AccessibilityObject*, DOMObjectVariant = nullptr);
@@ -555,7 +557,9 @@ inline void AXObjectCache::deferRecomputeIsIgnored(Element*) { }
 inline void AXObjectCache::deferTextChangedIfNeeded(Node*) { }
 inline void AXObjectCache::deferSelectedChildrenChangedIfNeeded(Element&) { }
 inline void AXObjectCache::deferTextReplacementNotificationForTextControl(HTMLTextFormControlElement&, const String&) { }
+#if !PLATFORM(COCOA)
 inline void AXObjectCache::detachWrapper(AXCoreObject*, AccessibilityDetachmentType) { }
+#endif
 inline void AXObjectCache::focusModalNodeTimerFired() { }
 inline void AXObjectCache::performCacheUpdateTimerFired() { }
 inline void AXObjectCache::frameLoadingEventNotification(Frame*, AXLoadingEvent) { }
index 4dc73ec..209eb8e 100644 (file)
@@ -106,10 +106,10 @@ Ref<AccessibilityNodeObject> AccessibilityNodeObject::create(Node* node)
     return adoptRef(*new AccessibilityNodeObject(node));
 }
 
-void AccessibilityNodeObject::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
+void AccessibilityNodeObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
 {
     // AccessibilityObject calls clearChildren.
-    AccessibilityObject::detach(detachmentType, cache);
+    AccessibilityObject::detachRemoteParts(detachmentType);
     m_node = nullptr;
 }
 
index 380d997..34702c1 100644 (file)
@@ -132,7 +132,6 @@ public:
     AccessibilityObject* parentObject() const override;
     AccessibilityObject* parentObjectIfExists() const override;
 
-    void detach(AccessibilityDetachmentType, AXObjectCache*) override;
     void childrenChanged() override;
     void updateAccessibilityRole() override;
 
@@ -143,6 +142,7 @@ public:
 
 protected:
     explicit AccessibilityNodeObject(Node*);
+    void detachRemoteParts(AccessibilityDetachmentType) override;
 
     AccessibilityRole m_ariaRole { AccessibilityRole::Unknown };
     mutable AccessibilityRole m_roleForMSAA { AccessibilityRole::Unknown };
index d803044..d2b61ff 100644 (file)
@@ -96,19 +96,17 @@ AccessibilityObject::~AccessibilityObject()
     ASSERT(isDetached());
 }
 
-void AccessibilityObject::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
+void AccessibilityObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
 {
     // Menu close events need to notify the platform. No element is used in the notification because it's a destruction event.
-    if (detachmentType == AccessibilityDetachmentType::ElementDestroyed && roleValue() == AccessibilityRole::Menu && cache)
-        cache->postNotification(nullptr, &cache->document(), AXObjectCache::AXMenuClosed);
-    
+    if (detachmentType == AccessibilityDetachmentType::ElementDestroyed && roleValue() == AccessibilityRole::Menu) {
+        if (auto* cache = axObjectCache())
+            cache->postNotification(nullptr, &cache->document(), AXObjectCache::AXMenuClosed);
+    }
+
     // Clear any children and call detachFromParent on them so that
     // no children are left with dangling pointers to their parent.
     clearChildren();
-
-#if ENABLE(ACCESSIBILITY)
-    setWrapper(nullptr);
-#endif
 }
 
 bool AccessibilityObject::isDetached() const
index f43cdf7..f2463e8 100644 (file)
@@ -96,9 +96,6 @@ struct AccessibilityText {
 bool nodeHasPresentationRole(Node*);
 
 class AccessibilityObject : public AXCoreObject {
-protected:
-    AccessibilityObject() = default;
-
 public:
     virtual ~AccessibilityObject();
 
@@ -108,9 +105,6 @@ public:
     void setObjectID(AXID id) override { m_id = id; }
     void init() override { }
 
-    // When the corresponding WebCore object that this AccessibilityObject
-    // wraps is deleted, it must be detached.
-    void detach(AccessibilityDetachmentType, AXObjectCache* = nullptr) override;
     bool isDetached() const override;
 
     bool isAccessibilityNodeObject() const override { return false; }
@@ -736,6 +730,10 @@ public:
     String documentEncoding() const override;
 
 protected:
+    AccessibilityObject() = default;
+    void detachRemoteParts(AccessibilityDetachmentType) override;
+    void detachPlatformWrapper(AccessibilityDetachmentType) override;
+
     AXID m_id { 0 };
     AccessibilityChildrenVector m_children;
     mutable bool m_haveChildren { false };
index 2d231bb..44d295d 100644 (file)
@@ -477,7 +477,7 @@ public:
 
     // When the corresponding WebCore object that this accessible object
     // represents is deleted, it must be detached.
-    virtual void detach(AccessibilityDetachmentType, AXObjectCache* = nullptr) = 0;
+    void detach(AccessibilityDetachmentType);
     virtual bool isDetached() const = 0;
 
     typedef Vector<RefPtr<AXCoreObject>> AccessibilityChildrenVector;
@@ -1078,9 +1078,11 @@ public:
 #if ENABLE(ACCESSIBILITY)
     AccessibilityObjectWrapper* wrapper() const { return m_wrapper.get(); }
     void setWrapper(AccessibilityObjectWrapper* wrapper) { m_wrapper = wrapper; }
+    void detachWrapper(AccessibilityDetachmentType);
 #else
     AccessibilityObjectWrapper* wrapper() const { return nullptr; }
     void setWrapper(AccessibilityObjectWrapper*) { }
+    void detachWrapper(AccessibilityDetachmentType) { }
 #endif
 
     virtual void overrideAttachmentParent(AXCoreObject* parent) = 0;
@@ -1129,7 +1131,10 @@ public:
     virtual uint64_t sessionID() const = 0;
     virtual String documentURI() const = 0;
     virtual String documentEncoding() const = 0;
-protected:
+private:
+    // Detaches this object from the objects it references and it is referenced by.
+    virtual void detachRemoteParts(AccessibilityDetachmentType) = 0;
+
 #if PLATFORM(COCOA)
     RetainPtr<WebAccessibilityObjectWrapper> m_wrapper;
 #elif PLATFORM(WIN)
@@ -1137,8 +1142,22 @@ protected:
 #elif USE(ATK)
     GRefPtr<WebKitAccessible> m_wrapper;
 #endif
+    virtual void detachPlatformWrapper(AccessibilityDetachmentType) = 0;
 };
 
+inline void AXCoreObject::detach(AccessibilityDetachmentType detachmentType)
+{
+    detachWrapper(detachmentType);
+    detachRemoteParts(detachmentType);
+    setObjectID(InvalidAXID);
+}
+
+inline void AXCoreObject::detachWrapper(AccessibilityDetachmentType detachmentType)
+{
+    detachPlatformWrapper(detachmentType);
+    m_wrapper = nullptr;
+}
+
 namespace Accessibility {
 
 template<typename T, typename F>
index 514788a..9034d69 100644 (file)
@@ -133,9 +133,9 @@ Ref<AccessibilityRenderObject> AccessibilityRenderObject::create(RenderObject* r
     return adoptRef(*new AccessibilityRenderObject(renderer));
 }
 
-void AccessibilityRenderObject::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
+void AccessibilityRenderObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
 {
-    AccessibilityNodeObject::detach(detachmentType, cache);
+    AccessibilityNodeObject::detachRemoteParts(detachmentType);
     
     detachRemoteSVGRoot();
     
index 3f34678..b202849 100644 (file)
@@ -149,8 +149,7 @@ public:
     void setValue(const String&) override;
     void setSelectedRows(AccessibilityChildrenVector&) override;
     AccessibilityOrientation orientation() const override;
-    
-    void detach(AccessibilityDetachmentType, AXObjectCache*) override;
+
     void textChanged() override;
     void addChildren() override;
     bool canHaveChildren() const override;
@@ -203,6 +202,7 @@ public:
 
 protected:
     explicit AccessibilityRenderObject(RenderObject*);
+    void detachRemoteParts(AccessibilityDetachmentType) override;
     ScrollableArea* getScrollableAreaIfScrollable() const override;
     void scrollTo(const IntPoint&) const override;
     
index d116edd..ace0113 100644 (file)
@@ -48,9 +48,9 @@ AccessibilityScrollView::~AccessibilityScrollView()
     ASSERT(isDetached());
 }
 
-void AccessibilityScrollView::detach(AccessibilityDetachmentType detachmentType, AXObjectCache* cache)
+void AccessibilityScrollView::detachRemoteParts(AccessibilityDetachmentType detachmentType)
 {
-    AccessibilityObject::detach(detachmentType, cache);
+    AccessibilityObject::detachRemoteParts(detachmentType);
     m_scrollView = nullptr;
 }
 
index 9bfaf15..39b3faa 100644 (file)
@@ -40,13 +40,13 @@ public:
     ScrollView* scrollView() const { return m_scrollView; }
 
     virtual ~AccessibilityScrollView();
-    void detach(AccessibilityDetachmentType, AXObjectCache*) override;
 
     AccessibilityObject* webAreaObject() const;
 
 private:
     explicit AccessibilityScrollView(ScrollView*);
-    
+    void detachRemoteParts(AccessibilityDetachmentType) override;
+
     ScrollableArea* getScrollableAreaIfScrollable() const override;
     void scrollTo(const IntPoint&) const override;
     bool computeAccessibilityIsIgnored() const override;
index 2640c69..cbc4960 100644 (file)
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
+#include "AXObjectCache.h"
 #include "HTMLSpanElement.h"
 #include "RenderBlock.h"
 #include "RenderInline.h"
 
 namespace WebCore {
 
+void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType detachmentType)
+{
+    if (auto* cache = axObjectCache())
+        cache->detachWrapper(this, detachmentType);
+}
+
 bool AccessibilityObject::accessibilityIgnoreAttachment() const
 {
     return false;
index f11bfa8..cc33a2b 100644 (file)
 
 namespace WebCore {
     
-void AXObjectCache::detachWrapper(AXCoreObject* obj, AccessibilityDetachmentType)
-{
-    [obj->wrapper() detach];
-    obj->setWrapper(nullptr);
-}
-
 void AXObjectCache::attachWrapper(AXCoreObject* obj)
 {
     RetainPtr<AccessibilityObjectWrapper> wrapper = adoptNS([[WebAccessibilityObjectWrapper alloc] initWithAccessibilityObject:obj]);
index 7e05acf..09b3534 100644 (file)
 
 namespace WebCore {
     
+void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType)
+{
+    [wrapper() detach];
+}
+
 void AccessibilityObject::detachFromParent()
 {
 }
index 2a9f366..fd86162 100644 (file)
@@ -407,9 +407,9 @@ void AXIsolatedObject::setParent(AXID parent)
     m_parent = parent;
 }
 
-void AXIsolatedObject::detach(AccessibilityDetachmentType, AXObjectCache*)
+void AXIsolatedObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)
 {
-    ASSERT(isMainThread());
+    ASSERT(isMainThread() ? detachmentType == AccessibilityDetachmentType::CacheDestroyed : detachmentType != AccessibilityDetachmentType::CacheDestroyed);
     for (const auto& childID : m_childrenIDs)
         tree()->nodeForID(childID)->detachFromParent();
 
@@ -427,14 +427,6 @@ void AXIsolatedObject::detachFromParent()
     m_parent = InvalidAXID;
 }
 
-void AXIsolatedObject::disconnect()
-{
-    ASSERT(isMainThread());
-    tree()->axObjectCache()->detachWrapper(this, AccessibilityDetachmentType::ElementDestroyed);
-    detach(AccessibilityDetachmentType::ElementDestroyed);
-    setObjectID(InvalidAXID);
-}
-
 void AXIsolatedObject::setTreeIdentifier(AXIsolatedTreeID treeIdentifier)
 {
     m_treeIdentifier = treeIdentifier;
index f89b1e8..6e50df7 100644 (file)
@@ -54,15 +54,15 @@ public:
     AXID objectID() const override { return m_id; }
     void init() override { }
 
-    void detach(AccessibilityDetachmentType, AXObjectCache* = nullptr) override;
     bool isDetached() const override;
-    void disconnect();
 
     void setTreeIdentifier(AXIsolatedTreeID);
     void setParent(AXID);
     void appendChild(AXID);
 
 private:
+    void detachRemoteParts(AccessibilityDetachmentType) override;
+    void detachPlatformWrapper(AccessibilityDetachmentType) override;
 
     AXID parent() const { return m_parent; }
     
index f28a41b..58e9387 100644 (file)
@@ -97,7 +97,7 @@ void AXIsolatedTree::removeTreeForPageID(PageIdentifier pageID)
         LockHolder treeLocker { tree->m_changeLogLock };
         for (const auto& axID : tree->m_readerThreadNodeMap.keys()) {
             if (auto object = tree->nodeForID(axID))
-                object->disconnect();
+                object->detach(AccessibilityDetachmentType::CacheDestroyed);
         }
         tree->m_readerThreadNodeMap.clear();
         treeLocker.unlockEarly();
@@ -164,21 +164,17 @@ void AXIsolatedTree::applyPendingChanges()
 {
     RELEASE_ASSERT(!isMainThread());
     LockHolder locker { m_changeLogLock };
-    Vector<Ref<AXIsolatedObject>> appendCopy;
-    std::swap(appendCopy, m_pendingAppends);
-    Vector<AXID> removeCopy({ WTFMove(m_pendingRemovals) });
-    locker.unlockEarly();
 
     // We don't clear the pending IDs beacause if the next round of updates does not modify them, then they stay the same
     // value without extra bookkeeping.
     m_focusedNodeID = m_pendingFocusedNodeID;
 
-    for (auto& item : appendCopy)
+    for (auto& item : m_pendingAppends)
         m_readerThreadNodeMap.add(item->objectID(), WTFMove(item));
 
-    for (auto item : removeCopy) {
+    for (auto& item : m_pendingRemovals) {
         if (auto object = nodeForID(item))
-            object->disconnect();
+            object->detach(AccessibilityDetachmentType::ElementDestroyed);
         m_readerThreadNodeMap.remove(item);
     }
 }
diff --git a/Source/WebCore/accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm b/Source/WebCore/accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm
new file mode 100644 (file)
index 0000000..61ec288
--- /dev/null
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2020 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "AXIsolatedObject.h"
+
+#if ENABLE(ACCESSIBILITY_ISOLATED_TREE) && PLATFORM(MAC)
+
+#import "WebAccessibilityObjectWrapperMac.h"
+
+namespace WebCore {
+
+void AXIsolatedObject::detachPlatformWrapper(AccessibilityDetachmentType)
+{
+    [wrapper() detach];
+}
+
+} // WebCore
+
+#endif // ENABLE(ACCESSIBILITY_ISOLATED_TREE) && PLATFORM(MAC)
index 42c6479..aa1f8f4 100644 (file)
@@ -232,12 +232,6 @@ static AXTextSelectionGranularity platformGranularityForWebCoreGranularity(WebCo
 
 namespace WebCore {
 
-void AXObjectCache::detachWrapper(AXCoreObject* obj, AccessibilityDetachmentType)
-{
-    [obj->wrapper() detach];
-    obj->setWrapper(nullptr);
-}
-
 void AXObjectCache::attachWrapper(AXCoreObject* obj)
 {
     RetainPtr<WebAccessibilityObjectWrapper> wrapper = adoptNS([[WebAccessibilityObjectWrapper alloc] initWithAccessibilityObject:obj]);
index 7f8d470..9e7550c 100644 (file)
 
 namespace WebCore {
 
+void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType)
+{
+    [wrapper() detach];
+}
+
 void AccessibilityObject::detachFromParent()
 {
     if (isAttachment())
index 4304d3b..84a0b24 100644 (file)
 
 #if ENABLE(ACCESSIBILITY)
 
+#include "AXObjectCache.h"
+
 namespace WebCore {
 
+void AccessibilityObject::detachPlatformWrapper(AccessibilityDetachmentType detachmentType)
+{
+    if (auto* cache = axObjectCache())
+        cache->detachWrapper(this, detachmentType);
+}
+
 bool AccessibilityObject::accessibilityIgnoreAttachment() const
 {
     return false;