AX: Isolated object can be detached in the midst of serving AXChildren, causing nullptr dereference

[Tyler Wilcock]

...

[Radar WebKit Bug Importer]

<rdar://problem/121282648>

[Tyler Wilcock]

Created attachment 469472 [details]
Patch

[Andres Gonzalez]

(In reply to Tyler Wilcock from comment #2)
> Created attachment 469472 [details]
> Patch

@@ -1567,7 +1545,7 @@ ALLOW_DEPRECATED_IMPLEMENTATIONS_END
         }
 #endif

-        if (!self.childrenVectorSize) {
+        if (backingObject->children().isEmpty()) {
             if (NSArray *children = [self renderWidgetChildren])
                 return children;
         }
@@ -1581,7 +1559,7 @@ ALLOW_DEPRECATED_IMPLEMENTATIONS_END
         if (backingObject->isTreeItem())
             return makeNSArray(backingObject->ariaTreeItemContent());

-        return self.childrenVectorArray;
+        return makeNSArray(backingObject->children());

AG: we should avoid calling backingObject->children() twice in this block, first for the size and down here for real.

[Tyler Wilcock]

Created attachment 469499 [details]
Patch

[Tyler Wilcock]

(In reply to Andres Gonzalez from comment #3)
> AG: we should avoid calling backingObject->children() twice in this block,
> first for the size and down here for real.
TW: Fixed!

[EWS]

Committed 273328@main (b571ec5131dc): <https://commits.webkit.org/273328@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 469499 [details].