Dominique Leuenberger
4f062e3ae0
- Add webkit2gtk3-boo1088932-a11y-state-set.patch: fix crash when atk_object_ref_state_set is called on an AtkObject that's being destroyed (boo#1088932 webkit#184366). OBS-URL: https://build.opensuse.org/request/show/596005 OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/webkit2gtk3?expand=0&rev=155
59 lines
3.3 KiB
Diff
59 lines
3.3 KiB
Diff
diff -urp webkitgtk-2.20.1.orig/Source/WebCore/accessibility/AccessibilityObject.cpp webkitgtk-2.20.1/Source/WebCore/accessibility/AccessibilityObject.cpp
|
|
--- webkitgtk-2.20.1.orig/Source/WebCore/accessibility/AccessibilityObject.cpp 2018-04-09 07:00:57.000000000 -0500
|
|
+++ webkitgtk-2.20.1/Source/WebCore/accessibility/AccessibilityObject.cpp 2018-04-10 21:07:52.446048647 -0500
|
|
@@ -1771,7 +1771,7 @@ void AccessibilityObject::updateBackingS
|
|
// Updating the layout may delete this object.
|
|
RefPtr<AccessibilityObject> protectedThis(this);
|
|
if (auto* document = this->document()) {
|
|
- if (!document->view()->layoutContext().isInRenderTreeLayout() && !document->inRenderTreeUpdate() && !document->inStyleRecalc())
|
|
+ if (!document->view()->layoutContext().isInRenderTreeLayout() && !document->inRenderTreeUpdate() && document->isSafeToUpdateStyleOrLayout())
|
|
document->updateLayoutIgnorePendingStylesheets();
|
|
}
|
|
updateChildrenIfNecessary();
|
|
diff -urp webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.cpp webkitgtk-2.20.1/Source/WebCore/dom/Document.cpp
|
|
--- webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.cpp 2018-03-05 05:36:37.000000000 -0600
|
|
+++ webkitgtk-2.20.1/Source/WebCore/dom/Document.cpp 2018-04-10 21:07:52.454048680 -0500
|
|
@@ -1940,11 +1940,10 @@ bool Document::needsStyleRecalc() const
|
|
return false;
|
|
}
|
|
|
|
-static bool isSafeToUpdateStyleOrLayout(const Document& document)
|
|
+bool Document::isSafeToUpdateStyleOrLayout() const
|
|
{
|
|
bool isSafeToExecuteScript = ScriptDisallowedScope::InMainThread::isScriptAllowed();
|
|
- auto* frameView = document.view();
|
|
- bool isInFrameFlattening = frameView && frameView->isInChildFrameWithFrameFlattening();
|
|
+ bool isInFrameFlattening = view() && view()->isInChildFrameWithFrameFlattening();
|
|
bool isAssertionDisabled = ScriptDisallowedScope::LayoutAssertionDisableScope::shouldDisable();
|
|
return isSafeToExecuteScript || isInFrameFlattening || !isInWebProcess() || isAssertionDisabled;
|
|
}
|
|
@@ -1967,7 +1966,7 @@ bool Document::updateStyleIfNeeded()
|
|
}
|
|
|
|
// The early exit above for !needsStyleRecalc() is needed when updateWidgetPositions() is called in runOrScheduleAsynchronousTasks().
|
|
- RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout(*this));
|
|
+ RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout());
|
|
|
|
resolveStyle();
|
|
return true;
|
|
@@ -1983,7 +1982,7 @@ void Document::updateLayout()
|
|
ASSERT_NOT_REACHED();
|
|
return;
|
|
}
|
|
- RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout(*this));
|
|
+ RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isSafeToUpdateStyleOrLayout());
|
|
|
|
RenderView::RepaintRegionAccumulator repaintRegionAccumulator(renderView());
|
|
|
|
diff -urp webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.h webkitgtk-2.20.1/Source/WebCore/dom/Document.h
|
|
--- webkitgtk-2.20.1.orig/Source/WebCore/dom/Document.h 2018-03-05 04:11:41.000000000 -0600
|
|
+++ webkitgtk-2.20.1/Source/WebCore/dom/Document.h 2018-04-10 21:07:52.454048680 -0500
|
|
@@ -1253,6 +1253,7 @@ public:
|
|
|
|
bool inStyleRecalc() const { return m_inStyleRecalc; }
|
|
bool inRenderTreeUpdate() const { return m_inRenderTreeUpdate; }
|
|
+ WEBCORE_EXPORT bool isSafeToUpdateStyleOrLayout() const;
|
|
|
|
void updateTextRenderer(Text&, unsigned offsetOfReplacedText, unsigned lengthOfReplacedText);
|
|
|