[Webkit-unassigned] [Bug 236057] New: AXIsolatedTree::updateChildren removes subtrees that should instead be moved

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=236057

            Bug ID: 236057
           Summary: AXIsolatedTree::updateChildren removes subtrees that
                    should instead be moved
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Accessibility
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: tyler_w at apple.com
                CC: andresg_22 at apple.com,
                    webkit-bug-importer at group.apple.com

In AXIsolatedTree::updateChildren, we can sometimes remove subtrees that are queued to be added somewhere else in the tree. Specifically, this can happen when:

  1. Object 123 is slated considered to be a new child based on the live AX tree, and we collect node changes for it.
  2. Object 123 is currently a member of a subtree of some other object in oldChildrenIDs.
  3. Because of 2, Object 123 is removed from the node map in removeSubtreeFromNodeMap and added to m_pendingSubtreeRemovals
  4. We try to queue the addition of this node somewhere in tree in queueChange, but ASSERT because Object 123 is not in the node map anymore.

This causes ASSERT(m_nodeMap.contains(objectID) in AXIsolatedTree::queueChange(const NodeChange&).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220203/b4d09d2a/attachment-0001.htm>