)]}'
{
  "commit": "98449fdd07de416f7e64287e9b6332c0bd9b0916",
  "tree": "ebe7bda3112cdee2525dc318f23836f1ae80599a",
  "parents": [
    "c026c76d4a39bb03661f38613df2c5cd36de79f2"
  ],
  "author": {
    "name": "Tyler Wilcock",
    "email": "tyler_w@apple.com",
    "time": "Sat Aug 27 22:49:14 2022"
  },
  "committer": {
    "name": "Alan Coon",
    "email": "alancoon@apple.com",
    "time": "Mon Aug 29 21:03:45 2022"
  },
  "message": "Cherry-pick 77ab8bd37796. rdar://problem/98729717\n\n    AX: AXObjectCache::remove(Node\u0026) can be called while performing a cache update causing m_deferred* vectors to be modified as we iterate over them\n    https://bugs.webkit.org/show_bug.cgi?id\u003d244421\n    rdar://98729717\n\n    Reviewed by Chris Fleizach.\n\n    Handling certain attribute changes in AXObjectCache::handleAttributeChange\n    can cause AXObjectCache::remove(Node\u0026) to be called as a side effect.\n    For example, this can happen as a result of a `role` attribute change.\n    When this happens, the Node is removed from m_deferredAttributeChanges while\n    we are iterating over this vector.\n\n    This patch prevents this by making AXObjectCache::remove(Node\u0026) bail\n    early before modifying any m_deferred* vector if we detect that we\u0027re in\n    the middle of a cache update. If this is true, these vectors will be\n    cleared anyways upon completion of their processing.\n\n    * LayoutTests/accessibility/multiple-attribute-change-crash-expected.txt: Added.\n    * LayoutTests/accessibility/multiple-attribute-change-crash.html: Added.\n    * LayoutTests/platform/ios/TestExpectations: Enable new test.\n    * LayoutTests/platform/glib/accessibility/multiple-attribute-change-crash-expected.txt: Added\n    * LayoutTests/platform/ios/accessibility/multiple-attribute-change-crash-expected.txt: Added.\n    * LayoutTests/platform/win/TestExpectations: Disable new test.\n    * Source/WebCore/accessibility/AXObjectCache.cpp:\n    (WebCore::AXObjectCache::remove):\n    (WebCore::AXObjectCache::handleAttributeChange):\n    Fix unchecked null dereference of the input Element* in an AXLOG.\n\n    Canonical link: https://commits.webkit.org/253871@main\n\nCanonical link: https://commits.webkit.org/252432.244@safari-7614.2.3.1-branch\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "2123447fc79f8da1d36a51e1a6c87d8f318e7e05",
      "new_mode": 33188,
      "new_path": "LayoutTests/accessibility/multiple-attribute-change-crash-expected.txt"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b60f706e647ecc73f52fcdccc60554e7f04da366",
      "new_mode": 33188,
      "new_path": "LayoutTests/accessibility/multiple-attribute-change-crash.html"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "6fdb13bc49aca2c3af2aedbefe1c57971427e8f6",
      "new_mode": 33188,
      "new_path": "LayoutTests/platform/glib/accessibility/multiple-attribute-change-crash-expected.txt"
    },
    {
      "type": "modify",
      "old_id": "20cac3ae6a0986adec09e056dc41b8c463e749da",
      "old_mode": 33188,
      "old_path": "LayoutTests/platform/ios/TestExpectations",
      "new_id": "d904c104e622296ffc9d5d4e9ea38f9e7e7ebfa6",
      "new_mode": 33188,
      "new_path": "LayoutTests/platform/ios/TestExpectations"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "04014f1f1357cf267cc20a4868db3fb5f94cee6d",
      "new_mode": 33188,
      "new_path": "LayoutTests/platform/ios/accessibility/multiple-attribute-change-crash-expected.txt"
    },
    {
      "type": "modify",
      "old_id": "b68a9fa41a5a3bcc5e5b36ebd3314546cfa3d14a",
      "old_mode": 33188,
      "old_path": "LayoutTests/platform/win/TestExpectations",
      "new_id": "763382c80e21080523f700807eeb8d6ac5e2054a",
      "new_mode": 33188,
      "new_path": "LayoutTests/platform/win/TestExpectations"
    },
    {
      "type": "modify",
      "old_id": "405e61c271ac533dcecc6b0f6a2d1b873c38ea94",
      "old_mode": 33188,
      "old_path": "Source/WebCore/accessibility/AXObjectCache.cpp",
      "new_id": "e7fbeef660fc97f832be6f0db86ef3b153986e18",
      "new_mode": 33188,
      "new_path": "Source/WebCore/accessibility/AXObjectCache.cpp"
    }
  ]
}