Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 62d7f19ba485e768f437050b9b146695883c2c02
https://github.com/WebKit/WebKit/commit/62d7f19ba485e768f437050b9b146695883c2c02
Author: Tyler Wilcock <[email protected]>
Date: 2026-07-10 (Fri, 10 Jul 2026)
Changed paths:
A
LayoutTests/accessibility/relations-update-during-node-removal-crash-expected.txt
A LayoutTests/accessibility/relations-update-during-node-removal-crash.html
M Source/WebCore/accessibility/AXObjectCache.cpp
M Source/WebCore/accessibility/AXObjectCache.h
Log Message:
-----------
AX: Null-pointer dereference rebuilding accessibility relations during node
removal
https://bugs.webkit.org/show_bug.cgi?id=318992
rdar://181844005
Reviewed by Chris Fleizach.
During node teardown (e.g. a GC sweep destroying DOM nodes),
AXObjectCache::remove(Node&)
-> remove(AXID) -> AXIsolatedTree::queueNodeRemoval() computes the removed
object's parent via
parentInCoreTree() -> AccessibilityNodeObject::ownerParentObject(). When
relations are dirty,
that reaches owners() -> relatedObjects(AXRelation::OwnedBy) ->
relatedObjectIDsFor(...,
UpdateRelations::Yes), which synchronously runs updateRelationsIfNeeded().
Rebuilding relations
walks the DOM and creates accessibility objects in the middle of node
destruction, dereferencing
a null pointer.
Guard against this with an m_isRemovingNode flag set across remove(AXID).
updateRelationsIfNeeded()
returns early while it is set. queueNodeRemoval() already reads relations
without updating them
for its LabelFor lookup (UpdateRelations::No), so this is consistent with the
existing intent.
Reading the current (stale) relations during removal is also correct. The
parent ID recorded by
queueNodeRemoval() must match the isolated tree's m_nodeMap, which reflects the
same last-built
relations. A fresh rebuild would desync from it and make
removeSubtreeFromNodeMap() bail.
*
LayoutTests/accessibility/relations-update-during-node-removal-crash-expected.txt:
Added.
* LayoutTests/accessibility/relations-update-during-node-removal-crash.html:
Added.
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::remove):
(WebCore::AXObjectCache::updateRelationsIfNeeded):
* Source/WebCore/accessibility/AXObjectCache.h:
Canonical link: https://commits.webkit.org/316915@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
