WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
NEW
250345
AX: Isolated trees queued for destruction will not be cleaned up unless an AX client requests an attribute from a wrapper in the destroyed tree
https://bugs.webkit.org/show_bug.cgi?id=250345
Summary
AX: Isolated trees queued for destruction will not be cleaned up unless an AX...
Tyler Wilcock
Reported
2023-01-09 16:13:52 PST
Currently, isolated trees are cleaned up like so: 1. AXObjectCache::~AXObjectCache() calls AXIsolatedTree::removeTreeForPageID(*m_pageID) 2. AXIsolatedTree::removeTreeForPageID calls AXIsolatedTree::queueForDestruction 3. AXIsolatedTree::queueForDestruction sets m_queuedForDestruction to true 4. The next time AXIsolatedTree::applyPendingChanges() is called, the tree is destroyed if m_queuedForDestruction is true Because this relies on AXIsolatedTree::applyPendingChanges() being called organically (i.e. an AX client requesting an attribute from a wrapper that is part of the soon-to-be-destroyed tree), it's possible we could never clean up a tree queued for destruction. AXIsolatedTree::queueForDestruction should probably set some internal timer to clean the tree up so we don't rely on AX clients requesting data from a soon-to-be-destroyed wrapper.
Attachments
Add attachment
proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1
2023-01-09 16:14:04 PST
<
rdar://problem/104050266
>
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug