[webkit-changes] [WebKit/WebKit] 435522: AX: Crash in [WebAccessibilityObjectWrapper textMa...

[AndresGonzalezApple]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 435522c0b0905a53843b3bf2d2b8fe9cda1e0609
      https://github.com/WebKit/WebKit/commit/435522c0b0905a53843b3bf2d2b8fe9cda1e0609
  Author: Andres Gonzalez <andresg_22 at apple.com>
  Date:   2023-08-15 (Tue, 15 Aug 2023)

  Changed paths:
    M Source/WebCore/accessibility/AXTextMarker.cpp

  Log Message:
  -----------
  AX: Crash in [WebAccessibilityObjectWrapper textMarkerRangeAtTextMarker:forUnit:].
https://bugs.webkit.org/show_bug.cgi?id=260187
rdar://110921099

Reviewed by Tyler Wilcock.

The crash was happening because the Node pointed to by the TextMarker is destroyed in a main loop cycle before it is used as the result of a request coming on the AX thread that is dispatched back to the main thread. This patch fixes the problem by checking whether the pointer is still in the AXObjectCache data structure that keeps track of the Nodes still alive and in use by TextMarkers.

* Source/WebCore/accessibility/AXTextMarker.cpp:
(WebCore::AXTextMarker::operator CharacterOffset const):

Canonical link: https://commits.webkit.org/266909@main