Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 698650b1c485482ace4dc78049deebdccfcff2fd
https://github.com/WebKit/WebKit/commit/698650b1c485482ace4dc78049deebdccfcff2fd
Author: Anne van Kesteren <[email protected]>
Date: 2026-10-10 (Sat, 10 Oct 2026)
Changed paths:
M Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
Log Message:
-----------
AX: AXIsolatedObject::setSelectedChildren() releases an isolated object on
the main thread
https://bugs.webkit.org/show_bug.cgi?id=327064
rdar://189678806
Reviewed by Tyler Wilcock.
AXIsolatedObject::setSelectedChildren() and setSelectedRows() capture a Ref to
the isolated
object in the function they send to the main thread, only to get the
AXObjectCache from it. That
function is destroyed on the main thread, so the isolated object is
dereferenced there. Its
reference count is not thread-safe, so this races with the accessibility
thread. In a Debug build
it fails the reference count threading assertion, for instance in
accessibility/select-element-at-index.html when run with
--accessibility-isolated-tree.
Get the AXObjectCache from the main-thread object that
performFunctionOnMainThread() passes to
the function instead, as performFunctionOnMainThread() intends, and stop
capturing the isolated
object.
No new tests: the test above covers setSelectedChildren(), and WebKitTestRunner
cannot set
selected rows.
Canonical link: https://commits.webkit.org/323331@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
