Commit 038bbdbe authored by cfleizach@apple.com's avatar cfleizach@apple.com

Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired

https://bugs.webkit.org/show_bug.cgi?id=27854



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@46604 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent ccd21477
2009-07-30 Chris Fleizach <cfleizach@apple.com>
Reviewed by Darin Adler.
Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
https://bugs.webkit.org/show_bug.cgi?id=27854
AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
they can disappear and then lead to crashes.
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::notificationPostTimerFired):
(WebCore::AXObjectCache::postNotification):
* accessibility/AXObjectCache.h:
2009-07-30 Simon Fraser <simon.fraser@apple.com>
Reviewed by Dan Bernstein.
......
......@@ -261,7 +261,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
unsigned i = 0, count = m_notificationsToPost.size();
for (i = 0; i < count; ++i) {
AccessibilityObject* obj = m_notificationsToPost[i].first;
AccessibilityObject* obj = m_notificationsToPost[i].first.get();
#ifndef NDEBUG
// Make sure none of the render views are in the process of being layed out.
// Notifications should only be sent after the renderer has finished
......@@ -308,7 +308,7 @@ void AXObjectCache::postNotification(RenderObject* renderer, const String& messa
if (!obj)
return;
m_notificationsToPost.append(make_pair(obj.get(), message));
m_notificationsToPost.append(make_pair(obj, message));
if (!m_notificationPostTimer.isActive())
m_notificationPostTimer.startOneShot(0);
}
......
......@@ -108,7 +108,7 @@ namespace WebCore {
HashSet<AXID> m_idsInUse;
Timer<AXObjectCache> m_notificationPostTimer;
Vector<pair<AccessibilityObject*, const String> > m_notificationsToPost;
Vector<pair<RefPtr<AccessibilityObject>, const String> > m_notificationsToPost;
void notificationPostTimerFired(Timer<AXObjectCache>*);
AXID getAXID(AccessibilityObject*);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment