In AXIsolatedTree::updateNode, we perform the update by queuing the node to be removed, and then queueing it to be added. When performing the removal in AXIsolatedTree::applyPendingChanges, we call AXCoreObject::detach, which unconditionally calls AXCoreObject::detachRemoteParts. Specifically, AXIsolatedObject::detachRemoteParts detaches all the object's children from the itself (by setting their m_parentID to zero). Then, when we start applying m_pendingAppends, we re-add the object, but never re-attach the children, resulting in a broken tree.
<rdar://problem/90932915>
Created attachment 455930 [details] Patch
Created attachment 455979 [details] Patch
(In reply to Tyler Wilcock from comment #3) > Created attachment 455979 [details] > Patch --- a/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp +++ a/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp @@ -307,7 +307,7 @@ void AXIsolatedTree::updateNode(AXCoreObject& axObject) - m_pendingNodeRemovals.append(axID); + m_pendingNodeRemovals.append(std::make_pair(axID, AccessibilityDetachmentType::ElementChanged)); Can we use an initializer list for the pair? m_pendingNodeRemovals.append({ axID, AccessibilityDetachmentType::ElementChanged }); @@ -545,10 +545,11 @@ void AXIsolatedTree::applyPendingChanges() + auto axID = removal.first; Don't need this local variable.
Created attachment 456028 [details] Patch
Committed r292086 (249013@main): <https://commits.webkit.org/249013@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 456028 [details].