[webkit-changes] [WebKit/WebKit] 002569: AX: Depending on the timing of Document::flushDefe...

[Tyler Wilcock]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0025697e602664cc2c95bd76d69f538cbb61a0f0
      https://github.com/WebKit/WebKit/commit/0025697e602664cc2c95bd76d69f538cbb61a0f0
  Author: Tyler Wilcock <tyler_w at apple.com>
  Date:   2024-01-31 (Wed, 31 Jan 2024)

  Changed paths:
    A LayoutTests/accessibility/tree-update-with-dirty-layout-expected.txt
    A LayoutTests/accessibility/tree-update-with-dirty-layout.html
    M LayoutTests/platform/glib/TestExpectations
    M LayoutTests/platform/ios/TestExpectations
    A LayoutTests/platform/ios/accessibility/tree-update-with-dirty-layout-expected.txt
    M LayoutTests/platform/mac-wk1/TestExpectations
    M LayoutTests/resources/accessibility-helper.js
    M Source/WebCore/accessibility/AXCoreObject.cpp
    M Source/WebCore/accessibility/AXCoreObject.h
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AXObjectCache.h
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  AX: Depending on the timing of Document::flushDeferredAXObjectCacheUpdate(), AXObjectCache::performDeferredCacheUpdate can be run with dirty layout
https://bugs.webkit.org/show_bug.cgi?id=268239
rdar://problem/121760427

Reviewed by Chris Fleizach and Andres Gonzalez.

In bug:

https://bugs.webkit.org/show_bug.cgi?id=256403 (Defer AX object cache update as an event loop task instead of a post layout task)

AXObjectCache::perfromDeferredCacheUpdate was moved from being a synchronous post-layout task to an asynchronous one,
running when possible via the EventLoop.

The problem with this is that by the time Document::flushDeferredAXObjectCacheUpdate() actually fires, layout may have
become dirty again, which means AXObjectCache::performDeferredCacheUpdate makes incorrect updates to the accessibility
tree. As one specific example, it can cause us to compute the wrong ignored value for RenderTexts, as we check
RenderText::hasRenderedText which may unexpectedly return false only because the layout is dirty.

With this patch, performDeferredCacheUpdate now detects when layout is dirty, and either waits another round in the event
loop or forces a layout if necessary. Waiting for a clean layout rather than forcing one is ideal, as layout is expensive.

* LayoutTests/accessibility/tree-update-with-dirty-layout-expected.txt: Added.
* LayoutTests/accessibility/tree-update-with-dirty-layout.html: Added.
* LayoutTests/platform/glib/TestExpectations: Disable new test.
* LayoutTests/platform/ios/TestExpectations: Enable new test.
* LayoutTests/platform/ios/accessibility/tree-update-with-dirty-layout-expected.txt: Added.
* Source/WebCore/accessibility/AXCoreObject.cpp:
(WebCore::Accessibility::inRenderTreeOrStyleUpdate): Added.
* Source/WebCore/accessibility/AXCoreObject.h:
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::performDeferredCacheUpdate):
(WebCore::AXObjectCache::performCacheUpdateTimerFired): Deleted.
* Source/WebCore/accessibility/AXObjectCache.h:
(WebCore::AXObjectCache::performCacheUpdateTimerFired):
* Source/WebCore/accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::updateBackingStore):
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::create):
* LayoutTests/resources/accessibility-helper.js:

Canonical link: https://commits.webkit.org/273844@main