Please sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
AX: Crash: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore:…
…:AXObjectCache::clearTextMarkerNodesInUse + 149 https://bugs.webkit.org/show_bug.cgi?id=139929 Reviewed by Darin Adler. Source/WebCore: When a frame is replaced, there were instances when it was not clearing its associated nodes in the accessibility text marker -> Node cache. This caused dead Nodes to be left in the cache which would eventually be accessed when the cache was cleaned out at a later time. To fix this we should be clearing out the cache in Document::prepareForDestruction, instead of Frame::disconnectOwnerElement. While working on this, it also exposed a problem where when a frame goes away, it doesn't inform its parent to update its children, which causes an ASSERT to be hit with this test as well. Tests: accessibility/frame-disconnect-textmarker-cache-crash.html * dom/Document.cpp: (WebCore::Document::prepareForDestruction): * page/Frame.cpp: (WebCore::Frame::disconnectOwnerElement): Remove cache management from here since it is superceded by code in Document::prepareForDestruction * page/FrameView.cpp: (WebCore::FrameView::removeFromAXObjectCache): LayoutTests: * accessibility/frame-disconnect-textmarker-cache-crash-expected.txt: Added. * accessibility/frame-disconnect-textmarker-cache-crash.html: Added. * accessibility/resources/frameset.html: Added. * accessibility/resources/inform-parent-of-load.html: Added. * accessibility/resources/text.html: Added. Canonical link: https://commits.webkit.org/158152@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@178038 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- Loading branch information
Showing with 164 additions and 13 deletions.
- +13 −0 LayoutTests/ChangeLog
- +9 −0 LayoutTests/accessibility/frame-disconnect-textmarker-cache-crash-expected.txt
- +87 −0 LayoutTests/accessibility/frame-disconnect-textmarker-cache-crash.html
- +1 −0 LayoutTests/accessibility/resources/frameset.html
- +12 −0 LayoutTests/accessibility/resources/inform-parent-of-load.html
- +5 −0 LayoutTests/accessibility/resources/text.html
- +25 −0 Source/WebCore/ChangeLog
- +8 −0 Source/WebCore/dom/Document.cpp
- +0 −12 Source/WebCore/page/Frame.cpp
- +4 −1 Source/WebCore/page/FrameView.cpp