Cherry-pick 9c6ff22. rdar://problem/109586801

AX: WebAccessibilityObjectWrapperBase and WKAccessibilityWebPageObjectBase should hold WeakPtrs to their associated backing objects https://bugs.webkit.org/show_bug.cgi?id=257071 rdar://109586801 Reviewed by Andres Gonzalez. Continue the transition to ubiquitous smart pointer member usage per https://github.com/WebKit/WebKit/wiki/Smart-Pointer-Usage-Guidelines. * Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm: (-[WebAccessibilityObjectWrapper axBackingObject]): * Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.h: * Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.mm: (-[WebAccessibilityObjectWrapperBase attachIsolatedObject:]): (-[WebAccessibilityObjectWrapperBase hasIsolatedObject]): (-[WebAccessibilityObjectWrapperBase axBackingObject]): Canonical link: https://commits.webkit.org/264429@main Identifier: 263322.506@safari-7616.1.14.11-branch
WebKit · May 23, 2023 · 33c1065 · 33c1065
1 parent 59c8eb6
commit 33c1065
Show file tree

Hide file tree

Showing 7 changed files with 13 additions and 18 deletions.
diff --git a/Source/WebCore/accessibility/AccessibilityObjectInterface.h b/Source/WebCore/accessibility/AccessibilityObjectInterface.h
@@ -40,6 +40,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/ObjectIdentifier.h>
 #include <wtf/RefCounted.h>
+#include <wtf/ThreadSafeWeakPtr.h>
 
 #if PLATFORM(WIN)
 #include "AccessibilityObjectWrapperWin.h"
@@ -832,7 +833,7 @@ struct AccessibilityIsIgnoredFromParentData {
     bool isNull() const { return !parent; }
 };
 
-class AXCoreObject : public ThreadSafeRefCounted<AXCoreObject> {
+class AXCoreObject : public ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr<AXCoreObject> {
 public:
     virtual ~AXCoreObject() = default;
 

diff --git a/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm b/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm
@@ -254,7 +254,7 @@ - (id)initWithAccessibilityObject:(AccessibilityObject*)axObject
 
 - (WebCore::AccessibilityObject *)axBackingObject
 {
-    return m_axObject;
+    return m_axObject.get();
 }
 
 - (void)detach

diff --git a/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp b/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
@@ -888,10 +888,6 @@ void AXIsolatedTree::applyPendingChanges()
         // The reference count of the just added IsolatedObject must be 2
         // because it is referenced by m_readerThreadNodeMap and m_pendingAppends.
         // When m_pendingAppends is cleared, the object will be held only by m_readerThreadNodeMap. The exception is the root node whose reference count is 3.
-        ASSERT_WITH_MESSAGE(
-            addResult.iterator->value->refCount() == 2 || (addResult.iterator->value.ptr() == m_rootNode.get() && m_rootNode->refCount() == 3),
-            "unexpected ref count after adding object to m_readerThreadNodeMap: %d", addResult.iterator->value->refCount()
-        );
     }
     m_pendingAppends.clear();
 

diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.h b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.h
@@ -56,10 +56,10 @@ RetainPtr<NSAttributedString> attributedStringCreate(Node*, StringView, AXCoreOb
 }
 
 @interface WebAccessibilityObjectWrapperBase : NSObject {
-    WebCore::AccessibilityObject* m_axObject;
+    WeakPtr<WebCore::AccessibilityObject> m_axObject;
 
 #if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
-    WebCore::AXIsolatedObject* m_isolatedObject;
+    ThreadSafeWeakPtr<WebCore::AXIsolatedObject> m_isolatedObject;
     // To be accessed only on the main thread.
     bool m_isolatedObjectInitialized;
 #endif

diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.mm
@@ -310,12 +310,12 @@ - (void)attachIsolatedObject:(AXIsolatedObject*)isolatedObject
         m_isolatedObjectInitialized = true;
 
     if (!_identifier.isValid())
-        _identifier = m_isolatedObject->objectID();
+        _identifier = m_isolatedObject.get()->objectID();
 }
 
 - (BOOL)hasIsolatedObject
 {
-    return !!m_isolatedObject;
+    return !!m_isolatedObject.get();
 }
 #endif
 
@@ -377,11 +377,11 @@ - (id)attachmentView
 - (WebCore::AXCoreObject*)axBackingObject
 {
     if (isMainThread())
-        return m_axObject;
+        return m_axObject.get();
 
 #if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
     ASSERT(AXObjectCache::isIsolatedTreeEnabled());
-    return m_isolatedObject;
+    return m_isolatedObject.get().get();
 #else
     ASSERT_NOT_REACHED();
     return nullptr;

diff --git a/Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.h b/Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.h
@@ -43,7 +43,7 @@ class AXCoreObject;
     Lock m_cacheLock;
     WebCore::FloatPoint m_position WTF_GUARDED_BY_LOCK(m_cacheLock);
     WebCore::IntSize m_size WTF_GUARDED_BY_LOCK(m_cacheLock);
-    NakedPtr<WebCore::AXCoreObject> m_isolatedTreeRoot WTF_GUARDED_BY_LOCK(m_cacheLock);
+    ThreadSafeWeakPtr<WebCore::AXCoreObject> m_isolatedTreeRoot;
 #endif
     RetainPtr<id> m_parent;
     bool m_hasMainFramePlugin;

diff --git a/Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm b/Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm
@@ -83,9 +83,8 @@ - (id)accessibilityRootObjectWrapper
 {
 #if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
     if (!isMainRunLoop()) {
-        Locker lock { m_cacheLock };
-        if (m_isolatedTreeRoot)
-            return m_isolatedTreeRoot->wrapper();
+        if (RefPtr root = m_isolatedTreeRoot.get())
+            return root->wrapper();
     }
 #endif
 
@@ -143,8 +142,7 @@ - (void)setSize:(const WebCore::IntSize&)size
 - (void)setIsolatedTreeRoot:(NakedPtr<WebCore::AXCoreObject>)root
 {
     ASSERT(isMainRunLoop());
-    Locker locker { m_cacheLock };
-    m_isolatedTreeRoot = root;
+    m_isolatedTreeRoot = root.get();
 }
 #endif