Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 08a38d85de0fb8d5866119df3b7d071f53054206
https://github.com/WebKit/WebKit/commit/08a38d85de0fb8d5866119df3b7d071f53054206
Author: Fujii Hironori <[email protected]>
Date: 2026-09-27 (Sun, 27 Sep 2026)
Changed paths:
M Source/WebCore/accessibility/atspi/AccessibilityAtspi.cpp
M Source/WebCore/accessibility/atspi/AccessibilityAtspi.h
Log Message:
-----------
[ATSPI] Web process crashes with RELEASE_ASSERT(!m_isConnecting) in
AccessibilityAtspi::registerObject() when it cannot own its a11y bus name (e.g.
Web Inspector in Flatpak)
https://bugs.webkit.org/show_bug.cgi?id=325394
rdar://188503396
Reviewed by Patrick Griffis.
AccessibilityAtspi::didConnect() requested the a11y bus name without a name_lost
handler. If the name couldn't be acquired, for example because the Web
Inspector's
web process in a Flatpak app isn't allowed to own it, didOwnName() was never
called,
so m_isConnecting stayed true forever. Once accessibility was enabled in that
process, which happens since 320566@main whenever another web process enables
it,
registerObject() hit RELEASE_ASSERT(!m_isConnecting).
Handle name_lost by disconnecting from the a11y bus. Object references are built
with the bus name, so accessibility can't work without it.
Reproduced without Flatpak by using a private a11y bus whose policy denies
owning
the name, see the bug for the steps.
* Source/WebCore/accessibility/atspi/AccessibilityAtspi.cpp:
(WebCore::AccessibilityAtspi::didConnect):
(WebCore::AccessibilityAtspi::didLoseName):
* Source/WebCore/accessibility/atspi/AccessibilityAtspi.h:
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Canonical link: https://commits.webkit.org/322028@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
