[webkit-changes] [WebKit/WebKit] 51ff7b: AX: Remote SVGs can share renderers, breaking the ...

[Joshua Hoffman]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 51ff7b13c7cad0be9490546d9ed82649e098a1fc
      https://github.com/WebKit/WebKit/commit/51ff7b13c7cad0be9490546d9ed82649e098a1fc
  Author: Joshua Hoffman <jhoffman23 at apple.com>
  Date:   2025-03-03 (Mon, 03 Mar 2025)

  Changed paths:
    A LayoutTests/accessibility/ax-thread-text-apis/svg-duplicated-expected.txt
    A LayoutTests/accessibility/ax-thread-text-apis/svg-duplicated.html
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
    M Source/WebCore/accessibility/AccessibilitySVGRoot.h

  Log Message:
  -----------
  AX: Remote SVGs can share renderers, breaking the accessibility tree
https://bugs.webkit.org/show_bug.cgi?id=289001
rdar://145677641

Reviewed by Tyler Wilcock.

When creating text marker ranges in AXTextMarker, we compute the order of the start and end text marker
by locating them in the accessibility tree. This method, `partialOrderByTraversal` walks the tree forward
and backward until it can locate one marker starting from the other. This walk uses nextInPreOrder and
previousInPreOrder, which walk the tree including ignored objects.

This new behavior, enabled with the AX Thread Text APIs feature, exposed an issue with remote SVG elements:
remote SVG elements can share renderers, which leads to two accessibility objects having the same child
(with the same AXID). This creates issues when walking the tree, and can lead us into an infinite loop.

To prevent this, if we detect that an SVG root object is already parented in another valid AX object, don't
add it as a child of a different element.

* LayoutTests/accessibility/ax-thread-text-apis/svg-duplicated-expected.txt: Added.
* LayoutTests/accessibility/ax-thread-text-apis/svg-duplicated.html: Added.
* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::addRemoteSVGChildren):
* Source/WebCore/accessibility/AccessibilitySVGRoot.h:

Canonical link: https://commits.webkit.org/291544@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications