Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8c8159f34720c0fbf31c175d57b843a38a33f1d7
https://github.com/WebKit/WebKit/commit/8c8159f34720c0fbf31c175d57b843a38a33f1d7
Author: Dominic Mazzoni <[email protected]>
Date: 2026-04-08 (Wed, 08 Apr 2026)
Changed paths:
M
LayoutTests/http/tests/site-isolation/accessibility/client/simple-iframe-expected.txt
M
LayoutTests/http/tests/site-isolation/accessibility/client/simple-iframe.html
M LayoutTests/platform/mac/TestExpectations
M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
M Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h
M Source/WebKit/UIProcess/API/C/WKContext.cpp
M Source/WebKit/UIProcess/API/C/WKContextPrivate.h
M Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm
M Source/WebKit/UIProcess/WebProcessPool.h
M Tools/WebKitTestRunner/mac/TestControllerMac.mm
Log Message:
-----------
AX: ASSERTION FAILED on AXIsolatedTree.cpp:249 when running
http/tests/site-isolation/accessibility/client/simple-iframe.html
rdar://173698630
https://bugs.webkit.org/show_bug.cgi?id=311114
Reviewed by Tyler Wilcock.
I intermittently hit this assertion failure when running
http/tests/site-isolation/accessibility/client/simple-iframe.html,
which tests accessibility with site isolation. By fiddling with the
test timing I was able to reproduce it reliably.
ASSERTION FAILED: AX: After applying pending root node, 15 reachable nodes but
17 are in the node map
reachableNodes.size() == m_readerThreadNodeMap.size()
/Volumes/Code/safari/OpenSource/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp(249)
: void WebCore::AXIsolatedTree::applyPendingRootNodeLocked()
1 WebCore::AXIsolatedTree::applyPendingRootNodeLocked()
2 WebCore::AXIsolatedTree::applyPendingChangesLocked()
3 WebCore::AXIsolatedTree::applyPendingChanges()
The bug happens when the in-process FrameHost (AccessibilityScrollView)
is replaced with the out-of-process FrameHost, and then the FrameHost ends up in
both m_pendingSubtreeRemovals and m_pendingAppends in applyPendingChangesLocked.
We never hit this before because it doesn't happen with DOM nodes or
LayoutObjects - if the old object was removed from the AX cache, then
it won't end up in m_pendingAppends. In this case both the old Widget
and the new Widget exist, so the assertion is telling us we're leaking
the old isolated objects.
With this fix, and with also implementing the allowAXAuthenticationForTesting
check in the UI process to allow client accessibility APIs to succeed for any
process, http/tests/site-isolation/accessibility/client/simple-iframe.html can
be enabled.
*
LayoutTests/http/tests/site-isolation/accessibility/client/simple-iframe-expected.txt:
* LayoutTests/http/tests/site-isolation/accessibility/client/simple-iframe.html:
* LayoutTests/platform/mac/TestExpectations:
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::queueRemovals):
(WebCore::AXIsolatedTree::queueRemovalsLocked):
(WebCore::AXIsolatedTree::queueAppendsAndRemovals):
(WebCore::AXIsolatedTree::updateChildren):
(WebCore::AXIsolatedTree::removeNode):
(WebCore::AXIsolatedTree::removeStaleAppends):
(WebCore::AXIsolatedTree::applyPendingChangesLocked):
* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h:
* Source/WebKit/UIProcess/API/C/WKContext.cpp:
(WKContextSetAllowAXAuthenticationForTesting):
* Source/WebKit/UIProcess/API/C/WKContextPrivate.h:
* Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm:
(WebKit::WebProcessProxy::isAXAuthenticated):
* Source/WebKit/UIProcess/WebProcessPool.h:
* Tools/WebKitTestRunner/mac/TestControllerMac.mm:
(WTR::TestController::initializeWebProcessAccessibility):
Canonical link: https://commits.webkit.org/310800@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
