[webkit-changes] [WebKit/WebKit] 128a8b: Crash in com.apple.WebKit.WebContent at com.apple....

[AndresGonzalezApple]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 128a8bc221a862c12827a8495d5a5ef7af18b6a5
      https://github.com/WebKit/WebKit/commit/128a8bc221a862c12827a8495d5a5ef7af18b6a5
  Author: Andres Gonzalez <andresg_22 at apple.com>
  Date:   2022-09-18 (Sun, 18 Sep 2022)

  Changed paths:
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AXObjectCache.h

  Log Message:
  -----------
  Crash in com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::AXObjectCache::isModalElement const)
https://bugs.webkit.org/show_bug.cgi?id=245317
rdar://99856492

Reviewed by Chris Fleizach.

AXObjectCache::updateCurrentModalNodeInternal was accessing a stale Element* in m_modalElements. The fix in this patch is to make m_modalElements a collection of WeakPtrs instead of raw pointers.

* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::findModalNodes):
(WebCore::AXObjectCache::updateCurrentModalNodeInternal):
(WebCore::AXObjectCache::remove):
(WebCore::AXObjectCache::prepareForDocumentDestruction):
(WebCore::AXObjectCache::performDeferredCacheUpdate):
* Source/WebCore/accessibility/AXObjectCache.h:

Canonical link: https://commits.webkit.org/254604@main