[webkit-changes] [216814] branches/safari-603-branch

Fri, 12 May 2017 20:11:04 -0700

Title: [216814] branches/safari-603-branch

Diff

Modified: branches/safari-603-branch/LayoutTests/ChangeLog (216813 => 216814)


--- branches/safari-603-branch/LayoutTests/ChangeLog	2017-05-13 03:03:37 UTC (rev 216813)
+++ branches/safari-603-branch/LayoutTests/ChangeLog	2017-05-13 03:09:57 UTC (rev 216814)
@@ -1,3 +1,18 @@
+2017-05-12  Jason Marcell  <jmarc...@apple.com>
+
+        Cherry-pick r216307. rdar://problem/32119568
+
+    2017-05-05  Zalan Bujtas  <za...@apple.com>
+
+            Renderers being destroyed should not be added to AX's deferred list.
+            https://bugs.webkit.org/show_bug.cgi?id=171768
+            <rdar://problem/31955660>
+
+            Reviewed by Simon Fraser.
+
+            * accessibility/crash-when-renderers-are-added-back-to-deferred-list-expected.txt: Added.
+            * accessibility/crash-when-renderers-are-added-back-to-deferred-list.html: Added.
+
 2017-05-10  Ryan Haddad  <ryanhad...@apple.com>
 
         Unreviewed test gardening.

Added: branches/safari-603-branch/LayoutTests/accessibility/crash-when-renderers-are-added-back-to-deferred-list-expected.txt (0 => 216814)


--- branches/safari-603-branch/LayoutTests/accessibility/crash-when-renderers-are-added-back-to-deferred-list-expected.txt	                        (rev 0)
+++ branches/safari-603-branch/LayoutTests/accessibility/crash-when-renderers-are-added-back-to-deferred-list-expected.txt	2017-05-13 03:09:57 UTC (rev 216814)
@@ -0,0 +1 @@
+PASS if no crash or assert.

Added: branches/safari-603-branch/LayoutTests/accessibility/crash-when-renderers-are-added-back-to-deferred-list.html (0 => 216814)


--- branches/safari-603-branch/LayoutTests/accessibility/crash-when-renderers-are-added-back-to-deferred-list.html	                        (rev 0)
+++ branches/safari-603-branch/LayoutTests/accessibility/crash-when-renderers-are-added-back-to-deferred-list.html	2017-05-13 03:09:57 UTC (rev 216814)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that accessibility ignores elements that are being destroyed</title>
+<script>
+if (window.accessibilityController)
+    accessibilityController.accessibleElementById("foo");
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
+<style>
+::-webkit-scrollbar-corner {
+    border: 1px solid green;
+}
+</style>
+</head>
+<body>
+PASS if no crash or assert.
+<div id=foo style="overflow: scroll; height: 10px;"></div>
+<script>
+document.body.offsetHeight;
+foo.style.display = "none";
+document.body.offsetHeight;
+</script>
+</body>
+</html>

Modified: branches/safari-603-branch/Source/WebCore/ChangeLog (216813 => 216814)


--- branches/safari-603-branch/Source/WebCore/ChangeLog	2017-05-13 03:03:37 UTC (rev 216813)
+++ branches/safari-603-branch/Source/WebCore/ChangeLog	2017-05-13 03:09:57 UTC (rev 216814)
@@ -1,3 +1,29 @@
+2017-05-12  Jason Marcell  <jmarc...@apple.com>
+
+        Cherry-pick r216307. rdar://problem/32119568
+
+    2017-05-05  Zalan Bujtas  <za...@apple.com>
+
+            Renderers being destroyed should not be added to AX's deferred list.
+            https://bugs.webkit.org/show_bug.cgi?id=171768
+            <rdar://problem/31955660>
+
+            Reviewed by Simon Fraser.
+
+            In certain cases, when custom scrollbars are present, while destroying the scrollbars' block parent, we
+              - first remove the block from the AX's deferred list (AXObjectCache::remove)
+              - destroy the render layer that owns the custom scrollbars (RenderLayer::destroyLayer)
+              - detach the scrollbars from the parent (block) (RenderObject::removeFromParent)
+                - clean up the block's lines (RenderBlock::deleteLines)
+                  - push the block back to the AX's deferred list (AXObjectCache::recomputeDeferredIsIgnored)
+            At this point no one will remove the current block from AX's deferred list.
+
+            Test: accessibility/crash-when-renderers-are-added-back-to-deferred-list.html
+
+            * accessibility/AXObjectCache.cpp:
+            (WebCore::AXObjectCache::recomputeDeferredIsIgnored):
+            (WebCore::AXObjectCache::deferTextChanged):
+
 2017-05-10  Matthew Hanson  <matthew_han...@apple.com>
 
         Fix order of merge from r212528. rdar://problem/31153819

Modified: branches/safari-603-branch/Source/WebCore/accessibility/AXObjectCache.cpp (216813 => 216814)


--- branches/safari-603-branch/Source/WebCore/accessibility/AXObjectCache.cpp	2017-05-13 03:03:37 UTC (rev 216813)
+++ branches/safari-603-branch/Source/WebCore/accessibility/AXObjectCache.cpp	2017-05-13 03:09:57 UTC (rev 216814)
@@ -2634,11 +2634,15 @@
 
 void AXObjectCache::recomputeDeferredIsIgnored(RenderBlock& renderer)
 {
+    if (renderer.beingDestroyed())
+        return;
     m_deferredCacheUpdateList.add(&renderer);
 }
 
 void AXObjectCache::deferTextChanged(RenderText& renderer)
 {
+    if (renderer.beingDestroyed())
+        return;
     m_deferredCacheUpdateList.add(&renderer);
 }
 

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to