Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fda73668c666d3bb2747f5a90d21be8592484209
https://github.com/WebKit/WebKit/commit/fda73668c666d3bb2747f5a90d21be8592484209
Author: Dawn Morningstar <[email protected]>
Date: 2026-05-26 (Tue, 26 May 2026)
Changed paths:
M Source/WebCore/accessibility/AXObjectCache.cpp
M Source/WebCore/accessibility/AXObjectCache.h
M Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
Log Message:
-----------
AX: skip wrapper attachment for AXLocalFrame
https://bugs.webkit.org/show_bug.cgi?id=315380
rdar://177734602
Reviewed by Dominic Mazzoni.
AccessibilityScrollView::addLocalFrameChild always replaces the AXLocalFrame's
wrapper via setWrapperFrom(*frameRoot), so the wrapper that
AXObjectCache::create() attaches is immediately discarded. That displaced
wrapper drops its last RetainPtr while still bound to the AXLocalFrame, which
trips -[WebAccessibilityObjectWrapper dealloc]'s
AX_ASSERT(!self.axBackingObject)
on iOS and (when wrapperA is later rebound) attachAXObject's objectID
assert on Mac.
Skip attachWrapper in AXObjectCache::create() for AccessibilityRole::LocalFrame.
The caller is responsible for installing the shared wrapper.
Also add the missing dealloc assertion to Mac's WebAccessibilityObjectWrapper
to mirror iOS, so future wrapper-lifetime regressions surface on either
platform.
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::create):
* Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper dealloc]):
Canonical link: https://commits.webkit.org/313915@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
