commit 1f67dd1e762c73f1a923e747ca2caa98f41f4481
author Jacobo Aragunde Pérez <jaragunde@igalia.com> Mon May 23 12:51:29 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon May 23 12:51:29 2022
tree 91e7d14171cf3a22021872d8b05439efbd3e761b
parent 3e62a12a81c04ba42279656b25ea8e7359b73921

Refresh cached attributes before name computation traversal.

It was possible to trigger a children clear operation while running
TextFromDescendants to compute a node name from its children. This
is the sequence:

* A node changes its aria-hidden value.
* We run TextFromDescendants on that node, it queries the hidden value
  for each child.
* To know the hidden value, it refreshes cached attributes in
  UpdateCachedAttributeValuesIfNeeded
* To refresh the cached aria-hidden value, it needs to check the
  parent's aria-hidden
* The parent also refreshes cached attributes in
  UpdateCachedAttributeValuesIfNeeded
* It detects aria-hidden value has changed, that triggers
  SetNeedsToUpdateChildren, which runs ClearChildren

To prevent children being cleared while we traverse them, which can
cause an invalid pointer being addressed, we run a refresh of cached
values before the traversal, knowing that operation may trigger a
children clear (and we will need to use those cached values anyway).

We also add a regression test, based on a clusterfuzz-generated one,
which is known to trigger this situation.

(cherry picked from commit 7880b4f179422725e67fef989a4f48bf5c0011c9)

Bug: 1315044
Change-Id: I0a7ca27cca5d93fbdbc07d31cab6a21b1401d8dc
AX-relnotes: prevent crash in name computation.
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3633568
Commit-Queue: Jacobo Aragunde Pérez <jaragunde@igalia.com>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1005708}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3655994
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/5060@{#175}
Cr-Branched-From: b83393d0f4038aeaf67f970a024d8101df7348d1-refs/heads/main@{#1002911}