Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d0dcddea0dd774ab14417e77ad39c8ccbb1b1bc1
https://github.com/WebKit/WebKit/commit/d0dcddea0dd774ab14417e77ad39c8ccbb1b1bc1
Author: Tyler Wilcock <[email protected]>
Date: 2026-03-04 (Wed, 04 Mar 2026)
Changed paths:
M LayoutTests/accessibility/aria-modal.html
M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
Log Message:
-----------
AX: Fix crashes and null-dereferences with ENABLE(ACCESSIBILITY_LOCAL_FRAME)
https://bugs.webkit.org/show_bug.cgi?id=309127
rdar://171676758
Reviewed by Joshua Hoffman.
Remove the AX_ASSERT(axObject.isIgnored()) in the RevealableText property
handler, which crashes when an object's ignored state changes between when a
property update is queued and when it is processed. With
ENABLE(ACCESSIBILITY_LOCAL_FRAME), the ignored-state computation changes for
certain objects (e.g. AccessibilityScrollView), causing this assertion to fire.
Also fix two null-dereferences in processQueuedNodeUpdates where the
AXObjectCache WeakPtr can become null during the property update loop but was
used without null-checks for updateRelations and mostRecentlyPaintedText.
Update aria-modal.html to use waitFor() when retrieving the OK button, since
with ENABLE(ACCESSIBILITY_LOCAL_FRAME) the button may not be immediately
unignored after the dialog is shown.
Fixes aria-modal.html with ITM + ENABLE(ACCESSIBILITY_LOCAL_FRAME).
* LayoutTests/accessibility/aria-modal.html:
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:
Canonical link: https://commits.webkit.org/308645@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
