Bug 250345
| Summary: | AX: Isolated trees queued for destruction will not be cleaned up unless an AX client requests an attribute from a wrapper in the destroyed tree | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Tyler Wilcock <tyler_w> |
| Component: | Accessibility | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | andresg_22, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Other | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Tyler Wilcock
Currently, isolated trees are cleaned up like so:
1. AXObjectCache::~AXObjectCache() calls AXIsolatedTree::removeTreeForPageID(*m_pageID)
2. AXIsolatedTree::removeTreeForPageID calls AXIsolatedTree::queueForDestruction
3. AXIsolatedTree::queueForDestruction sets m_queuedForDestruction to true
4. The next time AXIsolatedTree::applyPendingChanges() is called, the tree is destroyed if m_queuedForDestruction is true
Because this relies on AXIsolatedTree::applyPendingChanges() being called organically (i.e. an AX client requesting an attribute from a wrapper that is part of the soon-to-be-destroyed tree), it's possible we could never clean up a tree queued for destruction. AXIsolatedTree::queueForDestruction should probably set some internal timer to clean the tree up so we don't rely on AX clients requesting data from a soon-to-be-destroyed wrapper.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/104050266>