haikuwebkit

nephele

AXObjectCache::performDeferredCacheUpdate is called recursively through FrameView::layout. https://bugs.webkit.org/show_bug.cgi?id=176218 <rdar://problem/34205612> Reviewed by Simon Fraser. Source/WebCore: There are certain cases when we might re-enter performDeferredCacheUpdate through recursive layout calls (see webkit.org/b/177176) and mutate m_deferredTextChangedList multiple times. Test: accessibility/crash-table-recursive-layout.html * accessibility/AXObjectCache.cpp: (WebCore::AXObjectCache::performDeferredCacheUpdate): * accessibility/AXObjectCache.h: LayoutTests: * accessibility/crash-table-recursive-layout-expected.txt: Added. * accessibility/crash-table-recursive-layout.html: Added. Canonical link: https://commits.webkit.org/193548@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@222226 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2017-09-19 21:23:18 +00:00			`PASS if no crash.`