Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 54845b1b874202434d8e0dc2bf032d4eb3236828
https://github.com/WebKit/WebKit/commit/54845b1b874202434d8e0dc2bf032d4eb3236828
Author: Tyler Wilcock <[email protected]>
Date: 2026-02-24 (Tue, 24 Feb 2026)
Changed paths:
A
LayoutTests/accessibility/shadow-host-style-invalidation-during-text-under-element-crash-expected.txt
A
LayoutTests/accessibility/shadow-host-style-invalidation-during-text-under-element-crash.html
M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
Log Message:
-----------
REGRESSION(305794@main): Unconditional CheckedPtr crash when loading any
Reddit post with VoiceOver active
https://bugs.webkit.org/show_bug.cgi?id=308467
rdar://170985963
Reviewed by Chris Fleizach.
Narrow the scope of the CheckedPtr<RenderStyle> in
AccessibilityNodeObject::textUnderElement
(added in 305794@main)so it does not live across the child iteration loop.
Previously, a CheckedPtr to the element's RenderStyle was captured at the
top of the function and held until return. During child iteration,
getOrCreate for a sibling slot element can trigger computedStyle() ->
resolveComputedStyle(), which walks the ancestor chain and re-resolves
the parent's m_computedStyle. This destroys the old RenderStyle that the
CheckedPtr still references, resulting in a crash (EXC_GUARD from
CheckedPtr accessing a scribbled-over object).
This happens specifically for display:none shadow hosts with slot
children, where a shadow-scoped stylesheet update sets
IsComputedStyleInvalidFlag on the host and slots. The flag is never
cleared by the style tree resolver because display:none subtrees without
renderers are not visited during resolveStyle, and
updateLayoutIgnorePendingStylesheets considers style clean despite the
flag persisting on non-rendered elements.
*
LayoutTests/accessibility/shadow-host-style-invalidation-during-text-under-element-crash-expected.txt:
Added.
*
LayoutTests/accessibility/shadow-host-style-invalidation-during-text-under-element-crash.html:
Added.
* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::textUnderElement const):
Canonical link: https://commits.webkit.org/308173@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
