Commit 4b732658 authored by Aaron Leventhal's avatar Aaron Leventhal Committed by Commit Bot

Fix crashes with a11y in embedded youtube

It is safe to access layout after a call to HandleLayoutComplete(), and
it should be done as soon as possible.

Exactly what leads to the fatal errors should still be investigated
anyway, but this is a simple fix and we still a way to repro.

Bug: 1131848,1125186
Change-Id: Ia529928fdee731f9fcf81d65a80edb49aadee9fe
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2436418
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: default avatarDominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#811553}
parent 53c06344
......@@ -1337,7 +1337,7 @@ void AXObject::UpdateCachedAttributeValuesIfNeeded() const {
#if DCHECK_IS_ON() // Required in order to get Lifecycle().ToString()
DCHECK(!GetDocument() || GetDocument()->Lifecycle().GetState() >=
DocumentLifecycle::kLayoutClean)
DocumentLifecycle::kAfterPerformLayout)
<< "Unclean document at lifecycle "
<< GetDocument()->Lifecycle().ToString();
#endif
......
......@@ -532,7 +532,8 @@ AXObject* AXObjectCacheImpl::GetOrCreate(Node* node) {
#if DCHECK_IS_ON()
Document* document = &node->GetDocument();
DCHECK(document);
DCHECK(document->Lifecycle().GetState() >= DocumentLifecycle::kLayoutClean)
DCHECK(document->Lifecycle().GetState() >=
DocumentLifecycle::kAfterPerformLayout)
<< "Unclean document at lifecycle " << document->Lifecycle().ToString();
#endif // DCHECK_IS_ON()
......@@ -574,7 +575,8 @@ AXObject* AXObjectCacheImpl::GetOrCreate(LayoutObject* layout_object) {
#if DCHECK_IS_ON()
Document* document = &layout_object->GetDocument();
DCHECK(document);
DCHECK(document->Lifecycle().GetState() >= DocumentLifecycle::kLayoutClean)
DCHECK(document->Lifecycle().GetState() >=
DocumentLifecycle::kAfterPerformLayout)
<< "Unclean document at lifecycle " << document->Lifecycle().ToString();
#endif // DCHECK_IS_ON()
......@@ -2369,21 +2371,14 @@ void AXObjectCacheImpl::HandleLoadCompleteWithCleanLayout(Node* document_node) {
void AXObjectCacheImpl::HandleLayoutComplete(Document* document) {
SCOPED_DISALLOW_LIFECYCLE_TRANSITION(*document);
DeferTreeUpdate(&AXObjectCacheImpl::HandleLayoutCompleteWithCleanLayout,
document);
}
void AXObjectCacheImpl::HandleLayoutCompleteWithCleanLayout(
Node* document_node) {
DCHECK(document_node);
DCHECK(IsA<Document>(document_node));
#if DCHECK_IS_ON()
Document* document = To<Document>(document_node);
DCHECK(document->Lifecycle().GetState() >= DocumentLifecycle::kLayoutClean)
<< "Unclean document at lifecycle " << document->Lifecycle().ToString();
#endif // DCHECK_IS_ON()
PostNotification(GetOrCreate(document_node),
ax::mojom::blink::Event::kLayoutComplete);
if (document->Lifecycle().GetState() >=
DocumentLifecycle::kAfterPerformLayout) {
PostNotification(GetOrCreate(document),
ax::mojom::blink::Event::kLayoutComplete);
} else {
DeferTreeUpdate(&AXObjectCacheImpl::EnsurePostNotification, document,
ax::mojom::blink::Event::kLayoutComplete);
}
}
void AXObjectCacheImpl::HandleScrolledToAnchor(const Node* anchor_node) {
......
......@@ -210,7 +210,6 @@ class MODULES_EXPORT AXObjectCacheImpl
void HandleAriaSelectedChangedWithCleanLayout(Node*);
void HandleNodeLostFocusWithCleanLayout(Node*);
void HandleNodeGainedFocusWithCleanLayout(Node*);
void HandleLayoutCompleteWithCleanLayout(Node*);
void HandleLoadCompleteWithCleanLayout(Node*);
void UpdateCacheAfterNodeIsAttachedWithCleanLayout(Node*);
void DidShowMenuListPopupWithCleanLayout(Node*);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment