We partially solved this in https://bugs.webkit.org/show_bug.cgi?id=157818, but that change isn't enough to prevent the problem in all cases.
<rdar://problem/101835073>
Created attachment 463364 [details] Patch
rdar://101506601
Comment on attachment 463364 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=463364&action=review > Source/WebCore/accessibility/AccessibilityRenderObject.cpp:408 > + return nextObject->nextSibling(); do we need to check if return nextObject->nextSibling(); == nil and then fall down to next case?
Created attachment 463365 [details] Patch
(In reply to chris fleizach from comment #4) > Comment on attachment 463364 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=463364&action=review > > > Source/WebCore/accessibility/AccessibilityRenderObject.cpp:408 > > + return nextObject->nextSibling(); > > do we need to check if return nextObject->nextSibling(); == nil and then > fall down to next case? No, because if we aren't able to compute a non-null nextSibling by this point then there is nothing left to do besides also returning nullptr. I've re-ordered the logic a bit in the latest revision to make this more clear.
Created attachment 463366 [details] Patch
(In reply to Tyler Wilcock from comment #7) > Created attachment 463366 [details] > Patch Don't we have a similar problem with previousSibling?
(In reply to Andres Gonzalez from comment #8) > (In reply to Tyler Wilcock from comment #7) > > Created attachment 463366 [details] > > Patch > > Don't we have a similar problem with previousSibling? Yeah, we might need to apply the same fix to previousSibling in the future. This fix is especially important for nextSibling because it's used in AccessibilityRenderObject::addChildren, while previousSibling is not. We can re-evaluate later on.
Committed 256363@main (ade47b72cbb4): <https://commits.webkit.org/256363@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 463366 [details].