Bug 248451 - AX: AXIsolatedObject::m_childrenIDs is cleared too early when processing AXIsolatedTree::m_pendingSubtreeRemovals
Summary: AX: AXIsolatedObject::m_childrenIDs is cleared too early when processing AXIs...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Accessibility (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Tyler Wilcock
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-11-28 18:09 PST by Tyler Wilcock
Modified: 2022-11-30 20:03 PST (History)
10 users (show)

See Also:


Attachments
Patch (6.93 KB, patch)
2022-11-28 19:09 PST, Tyler Wilcock
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Tyler Wilcock 2022-11-28 18:09:08 PST
In AXIsolatedTree::applyPendingChanges(), when processing m_pendingSubtreeRemovals, we start by taking the last axID in the Vector and using it to get the associated nodeForID(). Then we call AXCoreObject::detach(AccessibilityDetachmentType::ElementDestroyed), which in turn calls AXIsolatedObject::detachRemoteParts. Currently, the implementation of this function loops over m_childrenIDs and detaches those children from `this`, and then clears m_childrenIDs.

Then, we jump back to AXIsolatedTree::applyPendingChanges() and run this line of code:

m_pendingSubtreeRemovals.appendVector(object->m_childrenIDs);

Which does nothing because we cleared m_childrenIDs as part of detachRemoteParts.
Comment 1 Radar WebKit Bug Importer 2022-11-28 18:09:34 PST
<rdar://problem/102743478>
Comment 2 Tyler Wilcock 2022-11-28 19:09:14 PST
Created attachment 463777 [details]
Patch
Comment 3 EWS 2022-11-30 20:03:26 PST
Committed 257217@main (b095a6aaca26): <https://commits.webkit.org/257217@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 463777 [details].