Bug 208844

Summary:

AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.

Product:

WebKit

Reporter:

James Craig <jcraig>

Component:

Accessibility

Assignee:

chris fleizach <cfleizach>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

aboxhall, apinheiro, awumstead, cdumez, cfleizach, commit-queue, darin, dmazzoni, esprehn+autocc, ews-watchlist, jdiggs, kangil.han, samuel_white, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

All

OS:

All

Attachments:

Description	Flags
patch	none

Description James Craig 2020-03-09 17:49:25 PDT

Saw this report on the A11y Slackers this morning. Filing it here. I don't have a test case yet.


"""
Running into major support issues with radio buttons that share a name attribute but exist in different shadow roots? Think encapsulated radio button components. The label for each radio is in the same shadow root as the radio.

Keyboard interaction doesn’t work as it normally would with radio buttons in Chrome, FF, or Safari. This doesn’t really surprise me, but dang, it’s bad.
In VO / Safari on macOS 10.15, navigating to the radio buttons crashes the page. This happens regardless of whether the radios are in a fieldset.
"""

Comment 1 Radar WebKit Bug Importer 2020-03-09 17:49:34 PDT

<rdar://problem/60252659>

Comment 2 James Craig 2020-03-09 18:18:20 PDT

"on the A11y Slackers ^channel^ this morning."
web-a11y.slack.com

Comment 3 awumstead 2020-03-09 18:41:42 PDT

Teat case:
Open https://codepen.io/mra11yx/pen/OJVzpBK or fork and open a debug mode view, in Safari, on macOS Catalina or iOS 13. 

Open VoiceOver. 

Navigate to either radio button. Safari, or the page, will crash, and only when VO is runninf.

Comment 4 James Craig 2020-03-16 18:15:55 PDT

Web Inspector Debugger tab changed significantly (merged into the Sources tab) so this deos not appear to be reproducible in Safari Tech Preview or nightlies.

Comment 5 James Craig 2020-03-16 18:21:50 PDT

Okay, new repro:

1. Enable Developer Menu
2. Load https://codepen.io/mra11yx/full/OJVzpBK
3. Show Inspector.
4. Select the Sources tab and show debugger, or run `debuggger` in the Web Inspector console.
5. Navigate VO back to the web page. 
6. Interact with the frame and navigate VO to the form element (right after the “fake” link). 
7. Tab to the first Radio button (Note: VO focus does not follow this visible focus)
8. Press right arrow key to change the radio button selection. 
9. WebKit crashes.

Comment 6 James Craig 2020-03-16 18:24:35 PDT

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000101df7841 WebCore::Position::getInlineBoxAndOffset(WebCore::EAffinity, WebCore::TextDirection, WebCore::InlineBox*&, int&) const + 129
1   com.apple.WebCore             	0x0000000102cd901d WebCore::AXObjectCache::localCaretRectForCharacterOffset(WebCore::RenderObject*&, WebCore::CharacterOffset const&) + 413
2   com.apple.WebCore             	0x0000000102d1038c WebCore::AccessibilityRenderObject::boundsForRange(WTF::RefPtr<WebCore::Range, WTF::DumbPtrTraits<WebCore::Range> >) const + 300
3   com.apple.WebCore             	0x0000000103d16fc6 -[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:] + 9894

Comment 7 chris fleizach 2020-03-17 12:59:16 PDT

Created attachment 393780 [details]
patch

Comment 8 WebKit Commit Bot 2020-03-17 16:02:41 PDT

Comment on attachment 393780 [details]
patch

Clearing flags on attachment: 393780

Committed r258609: <https://trac.webkit.org/changeset/258609>

Comment 9 WebKit Commit Bot 2020-03-17 16:02:42 PDT

All reviewed patches have been landed.  Closing bug.