diff -urp webkitgtk-2.20.1.orig/Source/WebCore/accessibility/AccessibilityObject.cpp webkitgtk-2.20.1/Source/WebCore/accessibility/AccessibilityObject.cpp --- webkitgtk-2.20.1.orig/Source/WebCore/accessibility/AccessibilityObject.cpp 2018-04-09 07:00:57.000000000 -0500 +++ webkitgtk-2.20.1/Source/WebCore/accessibility/AccessibilityObject.cpp 2018-04-10 21:07:52.446048647 -0500 @@ -1771,7 +1771,7 @@ void AccessibilityObject::updateBackingS // Updating the layout may delete this object. RefPtr protectedThis(this); if (auto* document = this->document()) { - if (!document->view()->layoutContext().isInRenderTreeLayout() && !document->inRenderTreeUpdate() && !document->inStyleRecalc()) + if (!document->view()->layoutContext().isInRenderTreeLayout() && !document->inRenderTreeUpdate() && document->isSafeToUpdateStyleOrLayout()) document->updateLayoutIgnorePendingStylesheets(); } updateChildrenIfNecessary(); diff -urp webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.cpp webkitgtk-2.20.1/Source/WebCore/dom/Document.cpp --- webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.cpp 2018-03-05 05:36:37.000000000 -0600 +++ webkitgtk-2.20.1/Source/WebCore/dom/Document.cpp 2018-04-10 21:07:52.454048680 -0500 @@ -1940,11 +1940,10 @@ bool Document::needsStyleRecalc() const return false; } -static bool isSafeToUpdateStyleOrLayout(const Document& document) +bool Document::isSafeToUpdateStyleOrLayout() const { bool isSafeToExecuteScript = ScriptDisallowedScope::InMainThread::isScriptAllowed(); - auto* frameView = document.view(); - bool isInFrameFlattening = frameView && frameView->isInChildFrameWithFrameFlattening(); + bool isInFrameFlattening = view() && view()->isInChildFrameWithFrameFlattening(); bool isAssertionDisabled = ScriptDisallowedScope::LayoutAssertionDisableScope::shouldDisable(); return isSafeToExecuteScript || isInFrameFlattening || !isInWebProcess() || isAssertionDisabled; } @@ -1967,7 +1966,7 @@ bool Document::updateStyleIfNeeded() } // The early exit above for !needsStyleRecalc() is needed when updateWidgetPositions() is called in runOrScheduleAsynchronousTasks(). - RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout(*this)); + RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout()); resolveStyle(); return true; @@ -1983,7 +1982,7 @@ void Document::updateLayout() ASSERT_NOT_REACHED(); return; } - RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout(*this)); + RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout()); RenderView::RepaintRegionAccumulator repaintRegionAccumulator(renderView()); diff -urp webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.h webkitgtk-2.20.1/Source/WebCore/dom/Document.h --- webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.h 2018-03-05 04:11:41.000000000 -0600 +++ webkitgtk-2.20.1/Source/WebCore/dom/Document.h 2018-04-10 21:07:52.454048680 -0500 @@ -1253,6 +1253,7 @@ public: bool inStyleRecalc() const { return m_inStyleRecalc; } bool inRenderTreeUpdate() const { return m_inRenderTreeUpdate; } + WEBCORE_EXPORT bool isSafeToUpdateStyleOrLayout() const; void updateTextRenderer(Text&, unsigned offsetOfReplacedText, unsigned lengthOfReplacedText);