256403 2023-05-05 17:56:13 -0700 Defer AX object cache update as an event loop task instead of a post layout task 2023-05-08 16:35:42 -0700 1 1 1 Unclassified WebKit Accessibility WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 256354 256383 1 rniwa rniwa andresg_22 webkit-bug-importer oldest_to_newest 1953339 0 rniwa 2023-05-05 17:56:13 -0700 We currently update AX caches as a post layout task. This is problematic because it can lead to arbitrary script execution: e.g. 3 0x2836d4250 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) 4 0x28376d6ac WebCore::Node::dispatchEvent(WebCore::Event&) 5 0x283699750 WebCore::Element::dispatchFocusEvent(WTF::RefPtr<WebCore::Element, WTF::RawPtrTraits<WebCore::Element>, WTF::DefaultRefDerefTraits<WebCore::Element>>&&, WebCore::FocusOptions const&) 6 0x2835c477c WebCore::Document::setFocusedElement(WebCore::Element*, WebCore::FocusOptions const&) 7 0x2843b3b48 WebCore::FocusController::setFocusedElement(WebCore::Element*, WebCore::LocalFrame&, WebCore::FocusOptions const&) 8 0x283698d64 WebCore::Element::focus(WebCore::FocusOptions const&) 9 0x282b8b80c WebCore::AccessibilityNodeObject::setFocused(bool) 10 0x282af3d4c WebCore::AXObjectCache::focusCurrentModal() 11 0x282afeda4 WebCore::AXObjectCache::performDeferredCacheUpdate() 12 0x28441f0c4 WebCore::LocalFrameView::performPostLayoutTasks() 13 0x28442a760 WebCore::LocalFrameViewLayoutContext::runAsynchronousTasks() 14 0x28442b7e8 WebCore::LocalFrameViewLayoutContext::runOrScheduleAsynchronousTasks() 15 0x28442b110 WebCore::LocalFrameViewLayoutContext::performLayout() 16 0x28440969c WebCore::LocalFrameViewLayoutContext::layout() 17 0x28441cbb0 WebCore::LocalFrameView::updateContentsSize() 18 0x2846a2f90 WebCore::ScrollView::updateScrollbars(WebCore::IntPoint const&) 19 0x2846a4858 WebCore::ScrollView::setContentsSize(WebCore::IntSize const&) 20 0x28440cafc WebCore::LocalFrameView::setContentsSize(WebCore::IntSize const&) 21 0x284406f7c WebCore::LocalFrameView::adjustViewSize() 22 0x28442afc0 WebCore::LocalFrameViewLayoutContext::performLayout() 23 0x28440969c WebCore::LocalFrameViewLayoutContext::layout() 24 0x2835adde8 WebCore::Document::updateLayout() 1953340 1 webkit-bug-importer 2023-05-05 17:56:28 -0700 <rdar://problem/108974696> 1953341 2 rniwa 2023-05-05 18:06:20 -0700 Pull request: https://github.com/WebKit/WebKit/pull/13528 1953863 3 ews-feeder 2023-05-08 15:46:11 -0700 Committed 263832@main (e8027f0de539): <https://commits.webkit.org/263832@main> Reviewed commits have been landed. Closing PR #13528 and removing active labels.