Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 28e2def3391fcf13871b39813d3c2fa8d91d9a06
https://github.com/WebKit/WebKit/commit/28e2def3391fcf13871b39813d3c2fa8d91d9a06
Author: Tyler Wilcock <[email protected]>
Date: 2026-06-04 (Thu, 04 Jun 2026)
Changed paths:
A
LayoutTests/accessibility/iframe-content-remains-accessible-after-navigation-expected.txt
A
LayoutTests/accessibility/iframe-content-remains-accessible-after-navigation.html
A LayoutTests/accessibility/resources/iframe-with-buttons.html
M Source/WebCore/accessibility/AXObjectCache.cpp
Log Message:
-----------
AX: AXObjectCache destructor wipes a newer cache's isolated tree out of
treeFrameCache during overlapping iframe document transitions
https://bugs.webkit.org/show_bug.cgi?id=316278
rdar://178166741
Reviewed by Dominic Mazzoni.
When an iframe's document is replaced, there can be a window in which two
AXObjectCaches for the same frameID are alive at once. When this happens,
the older cache's destructor calls
AXIsolatedTree::removeTreeForFrameID(m_frameID)
unconditionally. By the time it runs, the newer cache may have already stored
its
own isolated tree under the same frameID, so the destructor wiped the newer
cache's tree out of treeFrameCache. This makes the the iframe's content
inaccessible.
With this commit, we now only remove the tree if it belongs to this cache
(treeID match). This is the same ownership check getOrCreateIsolatedTree()
already
uses for its active "navigation removal" path.
*
LayoutTests/accessibility/iframe-content-remains-accessible-after-navigation-expected.txt:
Added.
*
LayoutTests/accessibility/iframe-content-remains-accessible-after-navigation.html:
Added.
* LayoutTests/accessibility/resources/iframe-with-buttons.html: Added.
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::~AXObjectCache):
Canonical link: https://commits.webkit.org/314572@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
