[webkit-changes] [WebKit/WebKit] edd3ae: AX: VoiceOver hangs in Safari when a select elemen...

[Tyler Wilcock]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: edd3aebf883a942b39a45c649da0218e74b9b4c2
      https://github.com/WebKit/WebKit/commit/edd3aebf883a942b39a45c649da0218e74b9b4c2
  Author: Tyler Wilcock <tyler_w at apple.com>
  Date:   2025-01-29 (Wed, 29 Jan 2025)

  Changed paths:
    A LayoutTests/accessibility/self-deleting-select-element-expected.txt
    A LayoutTests/accessibility/self-deleting-select-element.html
    M Source/WebCore/accessibility/AccessibilityObject.cpp

  Log Message:
  -----------
  AX: VoiceOver hangs in Safari when a select element deletes itself as a result of an onchange event
https://bugs.webkit.org/show_bug.cgi?id=286690
rdar://143830006

Reviewed by Chris Fleizach.

AccessibilityObject::documentFrameView() is called a result of isIgnored(). When we process tree updates as a result
of a select element removing itself from the DOM, we can get into an infinite loop, as there may be strong references
to the select accessibility object on the stack, but its renderer and node are gone. So when a descendant iterates up
to it in AccessibilityObject::documentFrameView(), we try to use it to get a documentFrameView() because it
isAccessibilityRenderObject(), even though it no longer has a renderer. Then the descendant continues trying to find
a documentFrameView(), hits the renderer-less and node-less ancestor select again, repeating forever.

Fix this by making AccessibilityObject::documentFrameView() ensure the AccessibilityRenderObject or AccessibilityNodeObject
it iterates to actually has a valid node or renderer.

* Source/WebCore/accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::documentFrameView const):
* LayoutTests/accessibility/self-deleting-select-element-expected.txt: Added.
* LayoutTests/accessibility/self-deleting-select-element.html: Added.

Canonical link: https://commits.webkit.org/289526@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications