[webkit-changes] [WebKit/WebKit] ace2a4: AX: AXIsolatedObject uses WeakPtr<AXIsolatedTree> ...

[Tyler Wilcock]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ace2a410b6ff6bb12ab58c616c49df671ab71f8b
      https://github.com/WebKit/WebKit/commit/ace2a410b6ff6bb12ab58c616c49df671ab71f8b
  Author: Tyler Wilcock <tyler_w at apple.com>
  Date:   2022-09-20 (Tue, 20 Sep 2022)

  Changed paths:
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp

  Log Message:
  -----------
  AX: AXIsolatedObject uses WeakPtr<AXIsolatedTree> in a different thread than it was created on
https://bugs.webkit.org/show_bug.cgi?id=245437
rdar://problem/100178376

Reviewed by Andres Gonzalez.

In https://bugs.webkit.org/show_bug.cgi?id=244941, we changed
AXIsolatedObject::m_cachedTree to be a WeakPtr<AXIsolatedTree> instead
of a RefPtr<AXIsolatedTree>. This is not correct since isolated objects
are created on the main-thread, but this cached tree is necessarily used
to help service requests on the secondary thread, and WeakPtr is not
thread-safe.

To fix this, we change m_cachedTree back to a RefPtr<AXIsolatedTree>.
This requires adding some more manual clean-up in the handling of
AXIsolatedTree::m_queuedForDestruction to ensure we remove any ref-cycles
that would prevent the associated AXIsolatedTree from being destroyed.

Behavior covered by existing test,
accessibility/ax-object-destroyed-on-reload.html.

* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h:
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::applyPendingChanges):

Canonical link: https://commits.webkit.org/254708@main