Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b59033bd026730f0634580dad8f2ed2203623c35
https://github.com/WebKit/WebKit/commit/b59033bd026730f0634580dad8f2ed2203623c35
Author: Tyler Wilcock <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/accessibility/accessible-name-chain-depth-no-crash-expected.txt
A LayoutTests/accessibility/accessible-name-chain-depth-no-crash.html
A LayoutTests/accessibility/accessible-name-recursion-no-crash-expected.txt
A LayoutTests/accessibility/accessible-name-recursion-no-crash.html
A
LayoutTests/accessibility/isolated-tree/accessible-name-recursion-no-crash-expected.txt
A
LayoutTests/accessibility/isolated-tree/accessible-name-recursion-no-crash.html
M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
Log Message:
-----------
AX: Cyclic and deeply chained accname computations can cause stack overflow
crashes
https://bugs.webkit.org/show_bug.cgi?id=324119
rdar://187335355
Reviewed by Chris Fleizach.
Computing an accessible name is recursive.
AccessibilityNodeObject::textUnderElement()
descends into a child's alternativeText(), which follows the ARIA relation and
host
language name paths (aria-labelledby, aria-describedby, <label>, <legend>,
<figcaption>,
tree items, slot assignments, display: contents shadow children) through
accessibleNameForNode(),
which computes the referenced node's name -- back through textUnderElement().
Nothing bounded that
descent, so content that either cycles or simply chains more name computations
than the stack can
hold recursed until the main thread overflows its stack.
With this commit, we track which nodes have been visited as part of the accname
computation,
and early-exit with an empty string if we encounter one we've already seen.
* LayoutTests/accessibility/accessible-name-recursion-no-crash-expected.txt:
Added.
* LayoutTests/accessibility/accessible-name-recursion-no-crash.html: Added.
*
LayoutTests/accessibility/isolated-tree/accessible-name-recursion-no-crash-expected.txt:
Added.
*
LayoutTests/accessibility/isolated-tree/accessible-name-recursion-no-crash.html:
Added.
* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:
(WebCore::accessibleNameForNode):
Canonical link: https://commits.webkit.org/321138@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
