Refactor: Clear m_axObjectCache when AXObject detaches

Source/modules/accessibility/AXLayoutObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 153 matching lines @@
 static LayoutBoxModelObject* nextContinuation(LayoutObject* layoutObject)
 {
     ASSERT(layoutObject);
     if (layoutObject->isLayoutInline() && !layoutObject->isReplaced())
         return toLayoutInline(layoutObject)->continuation();
     if (layoutObject->isLayoutBlock())
         return toLayoutBlock(layoutObject)->inlineElementContinuation();
     return 0;
 }
 
-AXLayoutObject::AXLayoutObject(LayoutObject* layoutObject, AXObjectCacheImpl* axObjectCache)
+AXLayoutObject::AXLayoutObject(LayoutObject* layoutObject, AXObjectCacheImpl& axObjectCache)
     : AXNodeObject(layoutObject->node(), axObjectCache)
     , m_layoutObject(layoutObject)
     , m_cachedElementRectDirty(true)
 {
 #if ENABLE(ASSERT)
     m_layoutObject->setHasAXObject(true);
 #endif
 }
 
-PassRefPtr<AXLayoutObject> AXLayoutObject::create(LayoutObject* layoutObject, AXObjectCacheImpl* axObjectCache)
+PassRefPtr<AXLayoutObject> AXLayoutObject::create(LayoutObject* layoutObject, AXObjectCacheImpl& axObjectCache)
 {
     return adoptRef(new AXLayoutObject(layoutObject, axObjectCache));
 }
 
 AXLayoutObject::~AXLayoutObject()
 {
     ASSERT(isDetached());
 }
 
 LayoutRect AXLayoutObject::elementRect() const
@@ skipping 369 matching lines @@
     if (isAttachment())
         return false;
 
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AXObject* controlObject = correspondingControlForLabelElement();
     if (controlObject && !controlObject->deprecatedExposesTitleUIElement() && controlObject->isCheckboxOrRadio()) {
         if (ignoredReasons) {
             HTMLLabelElement* label = labelElementContainer();
             if (label && !label->isSameNode(node())) {
-                AXObject* labelAXObject = axObjectCache()->getOrCreate(label);
+                AXObject* labelAXObject = axObjectCache().getOrCreate(label);
                 ignoredReasons->append(IgnoredReason(AXLabelContainer, labelAXObject));
             }
 
             ignoredReasons->append(IgnoredReason(AXLabelFor, controlObject));
         }
         return true;
     }
 
     if (m_layoutObject->isBR())
         return false;
@@ skipping 436 matching lines @@
     if (m_layoutObject->isLayoutInline())
         inlineBox = toLayoutInline(m_layoutObject)->lastLineBox();
     else if (m_layoutObject->isText())
         inlineBox = toLayoutText(m_layoutObject)->lastTextBox();
     else
         return 0;
 
     AXObject* result = 0;
     for (InlineBox* next = inlineBox->nextOnLine(); next; next = next->nextOnLine()) {
         LayoutObject* layoutObject = &next->layoutObject();
-        result = axObjectCache()->getOrCreate(layoutObject);
+        result = axObjectCache().getOrCreate(layoutObject);
         if (result)
             break;
     }
 
     // A static text node might span multiple lines. Try to return the first inline
     // text box within that static text if possible.
     if (result && result->roleValue() == StaticTextRole && result->children().size())
         result = result->children()[0].get();
 
     return result;
 }
 
 AXObject* AXLayoutObject::previousOnLine() const
 {
     if (!m_layoutObject)
         return 0;
 
     InlineBox* inlineBox;
     if (m_layoutObject->isLayoutInline())
         inlineBox = toLayoutInline(m_layoutObject)->firstLineBox();
     else if (m_layoutObject->isText())
         inlineBox = toLayoutText(m_layoutObject)->firstTextBox();
     else
         return 0;
 
     AXObject* result = 0;
     for (InlineBox* prev = inlineBox->prevOnLine(); prev; prev = prev->prevOnLine()) {
         LayoutObject* layoutObject = &prev->layoutObject();
-        result = axObjectCache()->getOrCreate(layoutObject);
+        result = axObjectCache().getOrCreate(layoutObject);
         if (result)
             break;
     }
 
     // A static text node might span multiple lines. Try to return the last inline
     // text box within that static text if possible.
     if (result && result->roleValue() == StaticTextRole && result->children().size())
         result = result->children()[result->children().size() - 1].get();
 
     return result;
@@ skipping 109 matching lines @@
         return 0;
 
     const AtomicString& activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr);
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
         return 0;
 
     Element* target = element->treeScope().getElementById(activeDescendantAttrStr);
     if (!target)
         return 0;
 
-    AXObject* obj = axObjectCache()->getOrCreate(target);
+    AXObject* obj = axObjectCache().getOrCreate(target);
 
     // An activedescendant is only useful if it has a layoutObject, because that's what's needed to post the notification.
     if (obj && obj->isAXLayoutObject())
         return obj;
 
     return 0;
 }
 
 void AXLayoutObject::ariaFlowToElements(AccessibilityChildrenVector& flowTo) const
 {
@@ skipping 217 matching lines @@
                 return summary;
 
             // The title attribute should be used as help text unless it is already being used as descriptive text.
             const AtomicString& title = toElement(curr->node())->getAttribute(titleAttr);
             if (!title.isEmpty() && description != title)
                 return title;
         }
 
         // Only take help text from an ancestor element if its a group or an unknown role. If help was
         // added to those kinds of elements, it is likely it was meant for a child element.
-        AXObject* axObj = axObjectCache()->getOrCreate(curr);
+        AXObject* axObj = axObjectCache().getOrCreate(curr);
         if (axObj) {
             AccessibilityRole role = axObj->roleValue();
             if (role != GroupRole && role != UnknownRole)
                 break;
         }
     }
 
     return String();
 }
 
@@ skipping 102 matching lines @@
     if (isHTMLAreaElement(node))
         return accessibilityImageMapHitTest(toHTMLAreaElement(node), point);
 
     if (isHTMLOptionElement(node))
         node = toHTMLOptionElement(*node).ownerSelectElement();
 
     LayoutObject* obj = node->layoutObject();
     if (!obj)
         return 0;
 
-    AXObject* result = axObjectCache()->getOrCreate(obj);
+    AXObject* result = axObjectCache().getOrCreate(obj);
     result->updateChildrenIfNecessary();
 
     // Allow the element to perform any hit-testing it might need to do to reach non-layout children.
     result = result->elementAccessibilityHitTest(point);
 
     if (result && result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
         if (result->isAXLayoutObject()) {
             AXObject* controlObject = toAXLayoutObject(result)->correspondingControlForLabelElement();
             if (controlObject && !controlObject->deprecatedExposesTitleUIElement())
@@ skipping 17 matching lines @@
 //
 // High-level accessibility tree access.
 //
 
 AXObject* AXLayoutObject::computeParent() const
 {
     if (!m_layoutObject)
         return 0;
 
     if (ariaRoleAttribute() == MenuBarRole)
-        return axObjectCache()->getOrCreate(m_layoutObject->parent());
+        return axObjectCache().getOrCreate(m_layoutObject->parent());
 
     // menuButton and its corresponding menu are DOM siblings, but Accessibility needs them to be parent/child
     if (ariaRoleAttribute() == MenuRole) {
         AXObject* parent = menuButtonForMenu();
         if (parent)
             return parent;
     }
 
     LayoutObject* parentObj = layoutParentObject();
     if (parentObj)
-        return axObjectCache()->getOrCreate(parentObj);
+        return axObjectCache().getOrCreate(parentObj);
 
     // WebArea's parent should be the scroll view containing it.
     if (isWebArea())
-        return axObjectCache()->getOrCreate(m_layoutObject->frame()->view());
+        return axObjectCache().getOrCreate(m_layoutObject->frame()->view());
 
     return 0;
 }
 
 AXObject* AXLayoutObject::computeParentIfExists() const
 {
     if (!m_layoutObject)
         return 0;
 
     if (ariaRoleAttribute() == MenuBarRole)
-        return axObjectCache()->get(m_layoutObject->parent());
+        return axObjectCache().get(m_layoutObject->parent());
 
     // menuButton and its corresponding menu are DOM siblings, but Accessibility needs them to be parent/child
     if (ariaRoleAttribute() == MenuRole) {
         AXObject* parent = menuButtonForMenu();
         if (parent)
             return parent;
     }
 
     LayoutObject* parentObj = layoutParentObject();
     if (parentObj)
-        return axObjectCache()->get(parentObj);
+        return axObjectCache().get(parentObj);
 
     // WebArea's parent should be the scroll view containing it.
     if (isWebArea())
-        return axObjectCache()->get(m_layoutObject->frame()->view());
+        return axObjectCache().get(m_layoutObject->frame()->view());
 
     return 0;
 }
 
 //
 // Low-level accessibility tree exploration, only for use within the accessibility module.
 //
 
 AXObject* AXLayoutObject::firstChild() const
 {
     if (!m_layoutObject)
         return 0;
 
     LayoutObject* firstChild = firstChildConsideringContinuation(m_layoutObject);
 
     if (!firstChild)
         return 0;
 
-    return axObjectCache()->getOrCreate(firstChild);
+    return axObjectCache().getOrCreate(firstChild);
 }
 
 AXObject* AXLayoutObject::nextSibling() const
 {
     if (!m_layoutObject)
         return 0;
 
     LayoutObject* nextSibling = 0;
 
     LayoutInline* inlineContinuation = m_layoutObject->isLayoutBlock() ? toLayoutBlock(m_layoutObject)->inlineElementContinuation() : 0;
@@ skipping 23 matching lines @@
             nextSibling = continuation;
         } else {
             // Case 5b: continuation is an inline - in this case the inline's first child is the next sibling.
             nextSibling = firstChildConsideringContinuation(continuation);
         }
     }
 
     if (!nextSibling)
         return 0;
 
-    return axObjectCache()->getOrCreate(nextSibling);
+    return axObjectCache().getOrCreate(nextSibling);
 }
 
 void AXLayoutObject::addChildren()
 {
     // If the need to add more children in addition to existing children arises,
     // childrenChanged should have been called, leaving the object with no children.
     ASSERT(!m_haveChildren);
 
     m_haveChildren = true;
 
     if (!canHaveChildren())
         return;
 
     Vector<AXObject*> ownedChildren;
     computeAriaOwnsChildren(ownedChildren);
 
     for (RefPtr<AXObject> obj = firstChild(); obj; obj = obj->nextSibling()) {
-        if (!axObjectCache()->isAriaOwned(obj.get()))
+        if (!axObjectCache().isAriaOwned(obj.get()))
             addChild(obj.get());
     }
 
     addHiddenChildren();
     addAttachmentChildren();
     addPopupChildren();
     addImageMapChildren();
     addTextFieldChildren();
     addCanvasChildren();
     addRemoteSVGChildren();
@@ skipping 70 matching lines @@
 
     // this is the LayoutObject's Document's LocalFrame's FrameView
     return m_layoutObject->document().view();
 }
 
 Element* AXLayoutObject::anchorElement() const
 {
     if (!m_layoutObject)
         return 0;
 
-    AXObjectCacheImpl* cache = axObjectCache();
+    AXObjectCacheImpl& cache = axObjectCache();
     LayoutObject* currLayoutObject;
 
     // Search up the layout tree for a LayoutObject with a DOM node. Defer to an earlier continuation, though.
     for (currLayoutObject = m_layoutObject; currLayoutObject && !currLayoutObject->node(); currLayoutObject = currLayoutObject->parent()) {
         if (currLayoutObject->isAnonymousBlock()) {
             LayoutObject* continuation = toLayoutBlock(currLayoutObject)->continuation();
             if (continuation)
-                return cache->getOrCreate(continuation)->anchorElement();
+                return cache.getOrCreate(continuation)->anchorElement();
         }
     }
 
     // bail if none found
     if (!currLayoutObject)
         return 0;
 
     // search up the DOM tree for an anchor element
     // NOTE: this assumes that any non-image with an anchor is an HTMLAnchorElement
     Node* node = currLayoutObject->node();
     for ( ; node; node = node->parentNode()) {
-        if (isHTMLAnchorElement(*node) || (node->layoutObject() && cache->getOrCreate(node->layoutObject())->isAnchor()))
+        if (isHTMLAnchorElement(*node) || (node->layoutObject() && cache.getOrCreate(node->layoutObject())->isAnchor()))
             return toElement(node);
     }
 
     return 0;
 }
 
 Widget* AXLayoutObject::widgetForAttachmentView() const
 {
     if (!isAttachment())
         return 0;
@@ skipping 94 matching lines @@
         }
 
         if (foundParent)
             break;
 
         containerParent = containerParent->parentObject();
     }
 
     // Post that the row count changed.
     if (containerParent)
-        axObjectCache()->postNotification(containerParent, AXObjectCacheImpl::AXRowCountChanged);
+        axObjectCache().postNotification(containerParent, AXObjectCacheImpl::AXRowCountChanged);
 
     // Post that the specific row either collapsed or expanded.
     AccessibilityExpanded expanded = isExpanded();
     if (!expanded)
         return;
 
     if (roleValue() == RowRole || roleValue() == TreeItemRole) {
         AXObjectCacheImpl::AXNotification notification = AXObjectCacheImpl::AXRowExpanded;
         if (expanded == ExpandedCollapsed)
             notification = AXObjectCacheImpl::AXRowCollapsed;
 
-        axObjectCache()->postNotification(this, notification);
+        axObjectCache().postNotification(this, notification);
     }
 }
 
 void AXLayoutObject::textChanged()
 {
     if (!m_layoutObject)
         return;
 
     Settings* settings = document()->settings();
     if (settings && settings->inlineTextBoxAccessibilityEnabled() && roleValue() == StaticTextRole)
@@ skipping 86 matching lines @@
 
     if (layoutObject()->needsLayout()) {
         // If a LayoutText needs layout, its inline text boxes are either
         // nonexistent or invalid, so defer until the layout happens and
         // the layoutObject calls AXObjectCacheImpl::inlineTextBoxesUpdated.
         return;
     }
 
     LayoutText* layoutText = toLayoutText(layoutObject());
     for (RefPtr<AbstractInlineTextBox> box = layoutText->firstAbstractInlineTextBox(); box.get(); box = box->nextInlineTextBox()) {
-        AXObject* axObject = axObjectCache()->getOrCreate(box.get());
+        AXObject* axObject = axObjectCache().getOrCreate(box.get());
         if (!axObject->accessibilityIsIgnored())
             m_children.append(axObject);
     }
 }
 
 void AXLayoutObject::lineBreaks(Vector<int>& lineBreaks) const
 {
     if (!isTextControl())
         return;
 
@@ skipping 64 matching lines @@
     int end = indexForVisiblePosition(visibleSelection.visibleEnd());
 
     return PlainTextRange(start, end - start);
 }
 
 bool AXLayoutObject::nodeIsTextControl(const Node* node) const
 {
     if (!node)
         return false;
 
-    const AXObject* axObjectForNode = axObjectCache()->getOrCreate(const_cast<Node*>(node));
+    const AXObject* axObjectForNode = axObjectCache().getOrCreate(const_cast<Node*>(node));
     if (!axObjectForNode)
         return false;
 
     return axObjectForNode->isTextControl();
 }
 
 bool AXLayoutObject::isTabItemSelected() const
 {
     if (!isTabItem() || !m_layoutObject)
         return false;
 
     Node* node = m_layoutObject->node();
     if (!node || !node->isElementNode())
         return false;
 
     // The ARIA spec says a tab item can also be selected if it is aria-labeled by a tabpanel
     // that has keyboard focus inside of it, or if a tabpanel in its aria-controls list has KB
     // focus inside of it.
     AXObject* focusedElement = focusedUIElement();
     if (!focusedElement)
         return false;
 
     WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
     elementsFromAttribute(elements, aria_controlsAttr);
 
     for (const auto& element : elements) {
-        AXObject* tabPanel = axObjectCache()->getOrCreate(element);
+        AXObject* tabPanel = axObjectCache().getOrCreate(element);
 
         // A tab item should only control tab panels.
         if (!tabPanel || tabPanel->roleValue() != TabPanelRole)
             continue;
 
         AXObject* checkFocusElement = focusedElement;
         // Check if the focused element is a descendant of the element controlled by the tab item.
         while (checkFocusElement) {
             if (tabPanel == checkFocusElement)
                 return true;
             checkFocusElement = checkFocusElement->parentObject();
         }
     }
 
     return false;
 }
 
 AXObject* AXLayoutObject::accessibilityImageMapHitTest(HTMLAreaElement* area, const IntPoint& point) const
 {
     if (!area)
         return 0;
 
-    AXObject* parent = axObjectCache()->getOrCreate(area->imageElement());
+    AXObject* parent = axObjectCache().getOrCreate(area->imageElement());
     if (!parent)
         return 0;
 
     for (const auto& child : parent->children()) {
         if (child->elementRect().contains(point))
             return child.get();
     }
 
     return 0;
 }
@@ skipping 101 matching lines @@
 
     if (!shouldInsertHiddenNodes)
         return;
 
     // Iterate through all of the children, including those that may have already been added, and
     // try to insert hidden nodes in the correct place in the DOM order.
     unsigned insertionIndex = 0;
     for (Node& child : NodeTraversal::childrenOf(*node)) {
         if (child.layoutObject()) {
             // Find out where the last layout sibling is located within m_children.
-            if (AXObject* childObject = axObjectCache()->get(child.layoutObject())) {
+            if (AXObject* childObject = axObjectCache().get(child.layoutObject())) {
                 if (childObject->accessibilityIsIgnored()) {
                     const auto& children = childObject->children();
                     childObject = children.size() ? children.last().get() : 0;
                 }
                 if (childObject)
                     insertionIndex = m_children.find(childObject) + 1;
                 continue;
             }
         }
 
         if (!isNodeAriaVisible(&child))
             continue;
 
         unsigned previousSize = m_children.size();
         if (insertionIndex > previousSize)
             insertionIndex = previousSize;
 
-        insertChild(axObjectCache()->getOrCreate(&child), insertionIndex);
+        insertChild(axObjectCache().getOrCreate(&child), insertionIndex);
         insertionIndex += (m_children.size() - previousSize);
     }
 }
 
 void AXLayoutObject::addTextFieldChildren()
 {
     Node* node = this->node();
     if (!isHTMLInputElement(node))
         return;
 
     HTMLInputElement& input = toHTMLInputElement(*node);
     Element* spinButtonElement = input.userAgentShadowRoot()->getElementById(ShadowElementNames::spinButton());
     if (!spinButtonElement || !spinButtonElement->isSpinButtonElement())
         return;
 
-    AXSpinButton* axSpinButton = toAXSpinButton(axObjectCache()->getOrCreate(SpinButtonRole));
+    AXSpinButton* axSpinButton = toAXSpinButton(axObjectCache().getOrCreate(SpinButtonRole));
     axSpinButton->setSpinButtonElement(toSpinButtonElement(spinButtonElement));
     axSpinButton->setParent(this);
     m_children.append(axSpinButton);
 }
 
 void AXLayoutObject::addImageMapChildren()
 {
     LayoutBoxModelObject* cssBox = layoutBoxModelObject();
     if (!cssBox || !cssBox->isLayoutImage())
         return;
 
     HTMLMapElement* map = toLayoutImage(cssBox)->imageMap();
     if (!map)
         return;
 
     for (HTMLAreaElement& area : Traversal<HTMLAreaElement>::descendantsOf(*map)) {
         // add an <area> element for this child if it has a link
         if (area.isLink()) {
-            AXImageMapLink* areaObject = toAXImageMapLink(axObjectCache()->getOrCreate(ImageMapLinkRole));
+            AXImageMapLink* areaObject = toAXImageMapLink(axObjectCache().getOrCreate(ImageMapLinkRole));
             areaObject->setHTMLAreaElement(&area);
             areaObject->setHTMLMapElement(map);
             areaObject->setParent(this);
             if (!areaObject->accessibilityIsIgnored())
                 m_children.append(areaObject);
             else
-                axObjectCache()->remove(areaObject->axObjectID());
+                axObjectCache().remove(areaObject->axObjectID());
         }
     }
 }
 
 void AXLayoutObject::addCanvasChildren()
 {
     if (!isHTMLCanvasElement(node()))
         return;
 
     // If it's a canvas, it won't have laid out children, but it might have accessible fallback content.
     // Clear m_haveChildren because AXNodeObject::addChildren will expect it to be false.
     ASSERT(!m_children.size());
     m_haveChildren = false;
     AXNodeObject::addChildren();
 }
 
 void AXLayoutObject::addAttachmentChildren()
 {
     if (!isAttachment())
         return;
 
     // FrameView's need to be inserted into the AX hierarchy when encountered.
     Widget* widget = widgetForAttachmentView();
     if (!widget || !widget->isFrameView())
         return;
 
-    AXObject* axWidget = axObjectCache()->getOrCreate(widget);
+    AXObject* axWidget = axObjectCache().getOrCreate(widget);
     if (!axWidget->accessibilityIsIgnored())
         m_children.append(axWidget);
 }
 
 void AXLayoutObject::addPopupChildren()
 {
     if (!isHTMLInputElement(node()))
         return;
     if (AXObject* axPopup = toHTMLInputElement(node())->popupRootAXObject())
         m_children.append(axPopup);
@@ skipping 75 matching lines @@
         result = LayoutRect(obj->absoluteBoundingBoxRect());
     } else {
         result = LayoutRect(obj->absoluteFocusRingBoundingBoxRect());
     }
 
     Document* document = this->document();
     if (document && document->isSVGDocument())
         offsetBoundingBoxForRemoteSVGElement(result);
     if (document && document->frame() && document->frame()->pagePopupOwner()) {
         IntPoint popupOrigin = document->view()->contentsToScreen(IntRect()).location();
-        IntPoint mainOrigin = axObjectCache()->rootObject()->documentFrameView()->contentsToScreen(IntRect()).location();
+        IntPoint mainOrigin = axObjectCache().rootObject()->documentFrameView()->contentsToScreen(IntRect()).location();
         result.moveBy(IntPoint(popupOrigin - mainOrigin));
     }
 
     // The size of the web area should be the content size, not the clipped size.
     if (isWebArea() && obj->frame()->view())
         result.setSize(LayoutSize(obj->frame()->view()->contentsSize()));
 
     // Checkboxes and radio buttons include their label as part of their rect.
     if (isCheckboxOrRadio()) {
         HTMLLabelElement* label = labelForElement(toElement(m_layoutObject->node()));
         if (label && label->layoutObject()) {
-            LayoutRect labelRect = axObjectCache()->getOrCreate(label)->elementRect();
+            LayoutRect labelRect = axObjectCache().getOrCreate(label)->elementRect();
             result.unite(labelRect);
         }
     }
 
     return result;
 }
 
 } // namespace blink