Merge r222546 - AX: Defer RenderImage's imageChanged event until afte…

…r layout is done. https://bugs.webkit.org/show_bug.cgi?id=177446 Reviewed by Dean Jackson. Source/WebCore: This is to avoid unintentional tree mutation during layout. Covered by existing tests. * rendering/RenderImage.cpp: (WebCore::RenderImage::imageChanged): LayoutTests: * accessibility/image-load-on-delay.html:
WebKit · Oct 17, 2017 · 7356e14 · 7356e14
1 parent 16eac30
commit 7356e14
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 2 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2017-09-26  Zalan Bujtas  <zalan@apple.com>
+
+        AX: Defer RenderImage's imageChanged event until after layout is done.
+        https://bugs.webkit.org/show_bug.cgi?id=177446
+
+        Reviewed by Dean Jackson.
+
+        * accessibility/image-load-on-delay.html:
+
 2017-09-27  Myles C. Maxfield  <mmaxfield@apple.com>
 
         Minimum font size may cause elements to have an infinite line-height

diff --git a/LayoutTests/accessibility/image-load-on-delay.html b/LayoutTests/accessibility/image-load-on-delay.html
@@ -18,18 +18,20 @@
     description("This verifies that when an image loads its resource late, the AX tree is updated to re-add the image.");
 
     if (window.accessibilityController) {
+          document.body.offsetHeight;
           window.jsTestIsAsync = true;
           var content = accessibilityController.accessibleElementById("content");
           debug("BEFORE: Group count: " + content.childrenCount);
 
           document.getElementById("image").onload = function() {
+              document.body.offsetHeight;
               debug("AFTER: Group count: " + content.childrenCount);
               finishJSTest();
           };
 
           setTimeout(function() { 
               document.getElementById("image").src = "resources/cake.png"; 
-          }, 1000);
+          }, 100);
     }
 
 </script>

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2017-09-26  Zalan Bujtas  <zalan@apple.com>
+
+        AX: Defer RenderImage's imageChanged event until after layout is done.
+        https://bugs.webkit.org/show_bug.cgi?id=177446
+
+        Reviewed by Dean Jackson.
+
+        This is to avoid unintentional tree mutation during layout.
+
+        Covered by existing tests.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged):
+
 2017-09-27  Myles C. Maxfield  <mmaxfield@apple.com>
 
         Minimum font size may cause elements to have an infinite line-height

diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
@@ -268,7 +268,7 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
 
     if (UNLIKELY(AXObjectCache::accessibilityEnabled())) {
         if (AXObjectCache* cache = document().existingAXObjectCache())
-            cache->recomputeIsIgnored(this);
+            cache->deferRecomputeIsIgnored(element());
     }
 
     repaintOrMarkForLayout(imageSizeChange, rect);