[webkit-changes] [WebKit/WebKit] 7a0745: AX: Accessibility relations become stale for objec...

[Tyler Wilcock]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 7a0745034449d8e3a7ce69d9d9d8a1918ae68b36
      https://github.com/WebKit/WebKit/commit/7a0745034449d8e3a7ce69d9d9d8a1918ae68b36
  Author: Tyler Wilcock <tyler_w at apple.com>
  Date:   2023-09-19 (Tue, 19 Sep 2023)

  Changed paths:
    M LayoutTests/accessibility-isolated-tree/TestExpectations
    M LayoutTests/accessibility/mac/grid-selected-cells-expected.txt
    M LayoutTests/accessibility/mac/grid-selected-cells.html
    M Source/WebCore/accessibility/AXLogger.cpp
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AXObjectCache.h
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/AccessibilityObject.h
    M Source/WebCore/accessibility/AccessibilityObjectInterface.h
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h

  Log Message:
  -----------
  AX: Accessibility relations become stale for objects that have a renderer attached after their creation
https://bugs.webkit.org/show_bug.cgi?id=261643
rdar://problem/115604027

Reviewed by Andres Gonzalez.

This patch fixes a bug initiated by this sequence:

  1. We create an AX object for an element that will eventually have a
     renderer, but does not have it yet. This object has some
     relationship to another element (e.g. via aria-activedescendant)
  2. Something triggers AXObjectCache::m_relations to be built.
  3. The renderer is created and attached to the element. AXObjectCache::onRendererCreated(Element&)
     is called, removing the old AX object. m_relations still has the now-stale entry to this old AX object.

With this patch, we detect this scenario and dirty relations when necessary.

This bug blocked fixing accessibility/mac/grid-selected-cells.html in ITM. But a couple more changes
were necessary to fully fix it:

  * Move AccessibilityObject::selectedCells to AXCoreObject and remove
    AXPropertyName::SelectedCells entirely. This obviates the need to update
    the property when relations change, as it is dependent on AXRelationType::ActiveDescendant.
  * Fix a bug where cells that dynamically change their aria-selected
    attribute were not updating AXPropertyName::IsSelected.

With this patch, accessibility/mac/grid-selected-cells.html passes in ITM.

* LayoutTests/accessibility-isolated-tree/TestExpectations:
* LayoutTests/accessibility/mac/grid-selected-cells-expected.txt:
* LayoutTests/accessibility/mac/grid-selected-cells.html:
* Source/WebCore/accessibility/AXLogger.cpp:
(WebCore::operator<<):
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::focusedObjectForNode):
(WebCore::AXObjectCache::onRendererCreated):
(WebCore::AXObjectCache::handleActiveDescendantChange):
(WebCore::AXObjectCache::performDeferredCacheUpdate):
(WebCore::AXObjectCache::updateIsolatedTree):
* Source/WebCore/accessibility/AXObjectCache.h:
* Source/WebCore/accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::selectedCells): Deleted.
(WebCore::AccessibilityObject::activeDescendant const): Deleted.
* Source/WebCore/accessibility/AccessibilityObject.h:
* Source/WebCore/accessibility/AccessibilityObjectInterface.h:
(WebCore::AXCoreObject::activeDescendant const):
(WebCore::AXCoreObject::selectedCells):
(WebCore::AXCoreObject::canHaveSelectedCells const): Deleted.
* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp:
(WebCore::AXIsolatedObject::initializeProperties):
(WebCore::AXIsolatedObject::activeDescendant const): Deleted.
* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h:
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h:

Canonical link: https://commits.webkit.org/268122@main