Skip to content

Commit a717593

Browse files
AndresGonzalezAppleAndresGonzalezApple
committed
AccessibilityObject::FocusedUIElement should not call AXObjectCache::focusedUIElementForPage that can return an isolated object.
https://bugs.webkit.org/show_bug.cgi?id=219238 Reviewed by Chris Fleizach. Since AXObjectCache::focusedUIElementForPage can return an isolated object, AccessibilityObject::focusedUIElement should not use it to determine the focused object. This causes that isolated objects may be accessed on the main thread when they shouldn't, and even infinite recursion if this happens when the isolated tree is being built. This patch changes AccessibilityObject::focusedUIElement to call AXObjectCache::focusedObjectForPage that always returns another AccessibilityObject. * accessibility/AXObjectCache.cpp: (WebCore::AXObjectCache::focusedObjectForPage): (WebCore::AXObjectCache::focusedUIElementForPage): (WebCore::AXObjectCache::generateIsolatedTree): (WebCore::AXObjectCache::focusedObject): Deleted. * accessibility/AXObjectCache.h: * accessibility/AccessibilityObject.cpp: (WebCore::AccessibilityObject::focusedUIElement const): Canonical link: https://commits.webkit.org/231863@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@270154 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 1f30421 commit a717593

4 files changed

Lines changed: 45 additions & 21 deletions

File tree

‎Source/WebCore/ChangeLog‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,27 @@
1+
2020-11-21 Andres Gonzalez <andresg_22@apple.com>
2+
3+
AccessibilityObject::FocusedUIElement should not call AXObjectCache::focusedUIElementForPage that can return an isolated object.
4+
https://bugs.webkit.org/show_bug.cgi?id=219238
5+
6+
Reviewed by Chris Fleizach.
7+
8+
Since AXObjectCache::focusedUIElementForPage can return an isolated
9+
object, AccessibilityObject::focusedUIElement should not use it to
10+
determine the focused object. This causes that isolated objects may be
11+
accessed on the main thread when they shouldn't, and even infinite
12+
recursion if this happens when the isolated tree is being built.
13+
This patch changes AccessibilityObject::focusedUIElement to call
14+
AXObjectCache::focusedObjectForPage that always returns another AccessibilityObject.
15+
16+
* accessibility/AXObjectCache.cpp:
17+
(WebCore::AXObjectCache::focusedObjectForPage):
18+
(WebCore::AXObjectCache::focusedUIElementForPage):
19+
(WebCore::AXObjectCache::generateIsolatedTree):
20+
(WebCore::AXObjectCache::focusedObject): Deleted.
21+
* accessibility/AXObjectCache.h:
22+
* accessibility/AccessibilityObject.cpp:
23+
(WebCore::AccessibilityObject::focusedUIElement const):
24+
125
2020-11-21 Zalan Bujtas <zalan@apple.com>
226

327
[LFC][IFC] Move current logicalLeft from ContinuousContent to LineStatus

‎Source/WebCore/accessibility/AXObjectCache.cpp‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -369,17 +369,29 @@ AccessibilityObject* AXObjectCache::focusedImageMapUIElement(HTMLAreaElement* ar
369369
return nullptr;
370370
}
371371

372-
AXCoreObject* AXObjectCache::focusedObject(Document& document)
372+
AXCoreObject* AXObjectCache::focusedObjectForPage(const Page* page)
373373
{
374-
Element* focusedElement = document.focusedElement();
374+
ASSERT(isMainThread());
375+
376+
if (!gAccessibilityEnabled)
377+
return nullptr;
378+
379+
// get the focused node in the page
380+
Document* document = page->focusController().focusedOrMainFrame().document();
381+
if (!document)
382+
return nullptr;
383+
384+
document->updateStyleIfNeeded();
385+
386+
Element* focusedElement = document->focusedElement();
375387
if (is<HTMLAreaElement>(focusedElement))
376388
return focusedImageMapUIElement(downcast<HTMLAreaElement>(focusedElement));
377389

378-
auto* axObjectCache = document.axObjectCache();
390+
auto* axObjectCache = document->axObjectCache();
379391
if (!axObjectCache)
380392
return nullptr;
381393

382-
AXCoreObject* focus = axObjectCache->getOrCreate(focusedElement ? focusedElement : static_cast<Node*>(&document));
394+
AXCoreObject* focus = axObjectCache->getOrCreate(focusedElement ? focusedElement : static_cast<Node*>(document));
383395
if (!focus)
384396
return nullptr;
385397

@@ -421,24 +433,12 @@ void AXObjectCache::setIsolatedTreeFocusedObject(Node* focusedNode)
421433

422434
AXCoreObject* AXObjectCache::focusedUIElementForPage(const Page* page)
423435
{
424-
ASSERT(isMainThread());
425-
if (!gAccessibilityEnabled)
426-
return nullptr;
427-
428-
// get the focused node in the page
429-
Document* focusedDocument = page->focusController().focusedOrMainFrame().document();
430-
if (!focusedDocument)
431-
return nullptr;
432-
433-
// Call this before isolated or non-isolated cases so the document is up to do.
434-
focusedDocument->updateStyleIfNeeded();
435-
436436
#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
437437
if (isIsolatedTreeEnabled())
438438
return isolatedTreeFocusedObject();
439439
#endif
440440

441-
return focusedObject(*focusedDocument);
441+
return focusedObjectForPage(page);
442442
}
443443

444444
AccessibilityObject* AXObjectCache::get(Widget* widget)
@@ -3179,7 +3179,7 @@ Ref<AXIsolatedTree> AXObjectCache::generateIsolatedTree(PageIdentifier pageID, D
31793179
if (axRoot)
31803180
tree->generateSubtree(*axRoot, nullptr, true);
31813181

3182-
auto* axFocus = axObjectCache->focusedObject(document);
3182+
auto* axFocus = axObjectCache->focusedObjectForPage(document.page());
31833183
if (axFocus)
31843184
tree->setFocusedNodeID(axFocus->objectID());
31853185

‎Source/WebCore/accessibility/AXObjectCache.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ class AXObjectCache {
145145
~AXObjectCache();
146146

147147
WEBCORE_EXPORT AXCoreObject* focusedUIElementForPage(const Page*);
148+
static AXCoreObject* focusedObjectForPage(const Page*);
148149

149150
// Returns the root object for the entire document.
150151
WEBCORE_EXPORT AXCoreObject* rootObject();
@@ -431,7 +432,6 @@ class AXObjectCache {
431432
AccessibilityObject* rootWebArea();
432433

433434
static AccessibilityObject* focusedImageMapUIElement(HTMLAreaElement*);
434-
static AXCoreObject* focusedObject(Document&);
435435

436436
AXID getAXID(AccessibilityObject*);
437437

‎Source/WebCore/accessibility/AccessibilityObject.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2544,12 +2544,12 @@ AXObjectCache* AccessibilityObject::axObjectCache() const
25442544
auto* document = this->document();
25452545
return document ? document->axObjectCache() : nullptr;
25462546
}
2547-
2547+
25482548
AXCoreObject* AccessibilityObject::focusedUIElement() const
25492549
{
25502550
auto* page = this->page();
25512551
auto* axObjectCache = this->axObjectCache();
2552-
return page && axObjectCache ? axObjectCache->focusedUIElementForPage(page) : nullptr;
2552+
return page && axObjectCache ? axObjectCache->focusedObjectForPage(page) : nullptr;
25532553
}
25542554

25552555
AccessibilitySortDirection AccessibilityObject::sortDirection() const

0 commit comments

Comments
 (0)