COMMIT_MESSAGE

AX: AccessibilityObject::insertChild does not check the validity of the insertionIndex while processing grandchildren
 
https://bugs.webkit.org/show_bug.cgi?id=241650

Reviewed by NOBODY (OOPS!).

When AccessibilityObject::insertChild is asked to insert a child that's

ignored, we instead add that object's children. However, both

`accessibilityIsIgnored` and `children` can cause layout, and said

layout could cause AccessibilityObject::m_children to be cleared. This

makes the `insertionIndex` invalid, which causes a crash.

In this patch, right before m_children.insert(), we check to make sure

the index is still valid.

I wasn't able to make a test for this bug. It is difficult to reproduce,

and the circumstances to reproduce are complex.

* Source/WebCore/accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::insertChild):

Source/WebCore/accessibility/AccessibilityObject.cpp

@@void AccessibilityObject::insertChild(AXCoreObject* newChild, unsigned index, De

                    // Even though `child` is ignored, we still need to set ancestry flags based on it.

                    grandchild->initializeAncestorFlags(childAncestorFlags);

                    grandchild->addAncestorFlags(thisAncestorFlags);

                    // Calls to `child->accessibilityIsIgnored()` or `child->children()` can cause layout, which in turn can cause this object to clear its m_children. This can cause `insertionIndex` to no longer be valid. Detect this and break early if necessary.

                    if (insertionIndex > m_children.size())

                        break;

                    m_children.insert(insertionIndex, grandchild);

                    ++insertionIndex;

                }