[webkit-changes] [WebKit/WebKit] 2206f4: AX: AXIsolatedTree::{collectNodeChangesForSubtree, ...

[Tyler Wilcock]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 2206f4c04ec44388ffa00a53bc87fbe00d975c59
      https://github.com/WebKit/WebKit/commit/2206f4c04ec44388ffa00a53bc87fbe00d975c59
  Author: Tyler Wilcock <tyler_w at apple.com>
  Date:   2024-10-17 (Thu, 17 Oct 2024)

  Changed paths:
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h

  Log Message:
  -----------
  AX: AXIsolatedTree::{collectNodeChangesForSubtree, removeSubtreeFromNodeMap} modify m_nodeMap children IDs when they shouldn't
https://bugs.webkit.org/show_bug.cgi?id=281642
rdar://138083925

Reviewed by Chris Fleizach.

A key component of AXIsolatedTree::updateChildren is comparing the "old" children (what is in the node map) for an
object vs. it's new children (the result of AccessibilityObject::children()). This makes AXIsolatedTree::{collectNodeChangesForSubtree, removeSubtreeFromNodeMap}'s
behavior of modifying the children IDs for existing entries in the node map problematic, as that can happen before we've
had a chance to call `updateChildren`, thus making the old and new children "match" even though they have actually changed
since we last ran `updateChildren`. This means we won't create a new node change for this object, resulting in stale
properties and missing children.

Address this by changing collectNodeChangesForSubtree to only modify children IDs in the node map for new entries,
and removing this behavior outright from `removeSubtreeFromNodeMap`. In both cases, the children IDs will be corrected
as necessary when `updateChildren` does run. This is also more efficient -- we are doing strictly less work.

This change is required to fix a test (changing-aria-hidden-with-display-none-parent.html) in an upcoming patch, which
exposes this bug. The specific sequence in this case is that `removeSubtreeFromNodeMap` modifies the node map for an
object right before we call `updateChildren` for it, making the `updateChildren` do the incorrect thing.

* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::collectNodeChangesForSubtree):
(WebCore::AXIsolatedTree::removeSubtreeFromNodeMap):
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h:
(WebCore::AXIsolatedTree::objectBecameIgnored):

Canonical link: https://commits.webkit.org/285352@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications