Bug 250345 - AX: Isolated trees queued for destruction will not be cleaned up unless an AX client requests an attribute from a wrapper in the destroyed tree
Summary: AX: Isolated trees queued for destruction will not be cleaned up unless an AX...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Accessibility (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-01-09 16:13 PST by Tyler Wilcock
Modified: 2023-01-09 16:14 PST (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tyler Wilcock 2023-01-09 16:13:52 PST 
Currently, isolated trees are cleaned up like so:

  1. AXObjectCache::~AXObjectCache() calls AXIsolatedTree::removeTreeForPageID(*m_pageID)
  2. AXIsolatedTree::removeTreeForPageID calls AXIsolatedTree::queueForDestruction
  3. AXIsolatedTree::queueForDestruction sets m_queuedForDestruction to true
  4. The next time AXIsolatedTree::applyPendingChanges() is called, the tree is destroyed if m_queuedForDestruction is true

Because this relies on AXIsolatedTree::applyPendingChanges() being called organically (i.e. an AX client requesting an attribute from a wrapper that is part of the soon-to-be-destroyed tree), it's possible we could never clean up a tree queued for destruction. AXIsolatedTree::queueForDestruction should probably set some internal timer to clean the tree up so we don't rely on AX clients requesting data from a soon-to-be-destroyed wrapper.
Comment 1 Radar WebKit Bug Importer 2023-01-09 16:14:04 PST 
<rdar://problem/104050266>