Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 96cb7254785e278d9f9342dbd326312d5c0905bf
https://github.com/WebKit/WebKit/commit/96cb7254785e278d9f9342dbd326312d5c0905bf
Author: Anne van Kesteren <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
A LayoutTests/accessibility/base-select-list-box-content-expected.txt
A LayoutTests/accessibility/base-select-list-box-content.html
M LayoutTests/accessibility/base-select-list-box-expected.txt
M LayoutTests/accessibility/base-select-list-box.html
A
LayoutTests/accessibility/isolated-tree/base-select-list-box-removal-expected.txt
A LayoutTests/accessibility/isolated-tree/base-select-list-box-removal.html
M LayoutTests/platform/glib/TestExpectations
M Source/WebCore/accessibility/AXCoreObject.cpp
M Source/WebCore/accessibility/AXObjectCache.cpp
M Source/WebCore/accessibility/AccessibilityListBoxOption.cpp
M Source/WebCore/accessibility/AccessibilityListBoxOption.h
M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
Log Message:
-----------
AX: more base appearance list box crashes in the accessibility tree
https://bugs.webkit.org/show_bug.cgi?id=326510
rdar://189297442
Reviewed by Tyler Wilcock.
A list box got its list items as accessibility children, as a RenderListBox
paints them
itself. Only options and optgroups took the select as their parent, though,
through
AccessibilityListBoxOption (322159@main). Other content takes its parent from
the composed
tree, so the parent of an <hr> in a base appearance list box was the list box
slot, which
the select does not have as a child. Walking the tree then hits SHOULD NEVER BE
REACHED in
AXCoreObject::indexInSiblings(), for instance when an <hr> follows an optgroup
or is the
last list item. Content that is not a list item, such as text, a <button>, or
an <a>, was
left out of the tree entirely, even though it can have focus.
A base appearance list box renders its content like any other element, so get
its children
from the composed tree instead. AccessibilityListBoxOption now only makes the
select the
parent of list items that a RenderListBox paints. Otherwise its optgroups are
groups that
contain their options. List boxes now look inside groups for their selected
children, which
also applies to ARIA listboxes. A select popover is now ignored unless it is a
base
appearance picker, as list boxes do not use theirs. A box type change does not
give the
popover a renderer, so its ignored state is recomputed when the children of its
select
change. This also puts the options of a multi-select dropdown box with a base
appearance
picker in its popover, as for a single-select one.
Separately, an option of a base appearance list box can still have an
accessibility object
when it is destroyed. With the isolated tree, removing that object asks for its
parent, and
AccessibilityListBoxOption::listBoxOptionParentNode() then checks the tag name
of a node
whose tag name is already gone. A node that is being destroyed has no parent,
so give up
when there is no parent, as AccessibilityNodeObject::parentObject() already
does.
Tests: accessibility/base-select-list-box-content.html
accessibility/isolated-tree/base-select-list-box-removal.html
Canonical link: https://commits.webkit.org/322932@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
