[Webkit-unassigned] [Bug 250126] New: RELEASE_ASSERT_NOT_REACHED in AccessibilityObjectAtspi::role() with MathML scripts

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=250126

            Bug ID: 250126
           Summary: RELEASE_ASSERT_NOT_REACHED in
                    AccessibilityObjectAtspi::role() with MathML scripts
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Accessibility
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: fred.wang at free.fr
                CC: andresg_22 at apple.com, cgarcia at igalia.com,
                    jdiggs at igalia.com, webkit-bug-importer at group.apple.com

Created attachment 464346

  --> https://bugs.webkit.org/attachment.cgi?id=464346&action=review

Reduced testcase

Original repro: Open https://www.mathjax.org/#samples and click the select element to change the rendering mode.

Attached is a testcase reduced with the help of lithium, which involves munder/mover/munderover elements.

We are reaching the following assert:

https://searchfox.org/wubkat/source/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp#393

Per https://w3c.github.io/mathml-aam/ AccessibilityObjectAtspi::effectiveRole() should return Atspi::Role::Section for isMathUnderOver().

Here is a simple fix:

diff --git a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
index 0a869b206589..afaf6b9b0fb7 100644
--- a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
+++ b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
@@ -1225,7 +1225,7 @@ std::optional<unsigned> AccessibilityObjectAtspi::effectiveRole() const
             return Atspi::Role::TableRow;
         if (m_coreObject->isMathTableCell())
             return Atspi::Role::TableCell;
-        if (m_coreObject->isMathSubscriptSuperscript() || m_coreObject->isMathMultiscript())
+        if (m_coreObject->isMathUnderOver() || m_coreObject->isMathSubscriptSuperscript() || m_coreObject->isMathMultiscript())
             return Atspi::Role::Section;
         if (m_coreObject->isMathFraction())
             return Atspi::Role::MathFraction;

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230105/cea75e70/attachment-0001.htm>