Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fca78fce775fba96c3a1d413450307c5ba24e723
https://github.com/WebKit/WebKit/commit/fca78fce775fba96c3a1d413450307c5ba24e723
Author: Zak Ridouh <[email protected]>
Date: 2026-10-11 (Sun, 11 Oct 2026)
Changed paths:
M Source/WebCore/accessibility/AccessibilityScrollView.cpp
Log Message:
-----------
ASSERTION FAILED: children[i]->indexInParent() == i in
AccessibilityScrollView::addChildren for a page with a cross-origin iframe
https://bugs.webkit.org/show_bug.cgi?id=327051
rdar://189658986
Reviewed by Tyler Wilcock.
AccessibilityScrollView::addRemoteFrameChild() bound a new AXRemoteFrame before
it added it as a child.
Binding passes the scroll view's wrapper to +[NSAccessibilityRemoteUIElement
remoteTokenForLocalUIElement:],
and AppKit can ask that wrapper for its window (it does while the screen-lock
shield is showing). The
wrapper's updateBackingStore() calls updateChildrenIfNecessary(), which always
rebuilds the scroll view's
children, so the nested call added the remote frame and the outer call added it
again, at index 1.
Add the child before binding, so a nested rebuild leaves one child.
No new tests. A layout test can't make AppKit call back. With that callback
simulated,
http/tests/site-isolation/accessibility/focus-in-remote-frame.html and the two
Web Inspector tests
in the bug crash before this change and pass after it.
* Source/WebCore/accessibility/AccessibilityScrollView.cpp:
(WebCore::AccessibilityScrollView::addRemoteFrameChild):
Canonical link: https://commits.webkit.org/323403@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
