In AXIsolatedTree::applyPendingChanges(), when processing m_pendingSubtreeRemovals, we start by taking the last axID in the Vector and using it to get the associated nodeForID(). Then we call AXCoreObject::detach(AccessibilityDetachmentType::ElementDestroyed), which in turn calls AXIsolatedObject::detachRemoteParts. Currently, the implementation of this function loops over m_childrenIDs and detaches those children from `this`, and then clears m_childrenIDs. Then, we jump back to AXIsolatedTree::applyPendingChanges() and run this line of code: m_pendingSubtreeRemovals.appendVector(object->m_childrenIDs); Which does nothing because we cleared m_childrenIDs as part of detachRemoteParts.
<rdar://problem/102743478>
Created attachment 463777 [details] Patch
Committed 257217@main (b095a6aaca26): <https://commits.webkit.org/257217@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 463777 [details].