Created attachment 464346 [details]
Reduced testcase

Original repro: Open https://www.mathjax.org/#samples and click the select element to change the rendering mode.

Attached is a testcase reduced with the help of lithium, which involves munder/mover/munderover elements.

We are reaching the following assert:

https://searchfox.org/wubkat/source/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp#393

Per https://w3c.github.io/mathml-aam/ AccessibilityObjectAtspi::effectiveRole() should return Atspi::Role::Section for isMathUnderOver().

Here is a simple fix:

diff --git a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
index 0a869b206589..afaf6b9b0fb7 100644
--- a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
+++ b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
@@ -1225,7 +1225,7 @@ std::optional<unsigned> AccessibilityObjectAtspi::effectiveRole() const
             return Atspi::Role::TableRow;
         if (m_coreObject->isMathTableCell())
             return Atspi::Role::TableCell;
-        if (m_coreObject->isMathSubscriptSuperscript() || m_coreObject->isMathMultiscript())
+        if (m_coreObject->isMathUnderOver() || m_coreObject->isMathSubscriptSuperscript() || m_coreObject->isMathMultiscript())
             return Atspi::Role::Section;
         if (m_coreObject->isMathFraction())
             return Atspi::Role::MathFraction;