241643 2022-06-15 12:36:12 -0700 AX ITM: Should not build an isolated tree branch rooted at an object with invalid ID. Should not attempt to remove an object for an invalid ID. 2022-06-15 19:18:34 -0700 1 1 1 Unclassified WebKit Accessibility WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 andresg_22 andresg_22 aboxhall andresg_22 apinheiro cfleizach dmazzoni ews-watchlist jcraig jdiggs samuel_white webkit-bug-importer oldest_to_newest 1876055 0 andresg_22 2022-06-15 12:36:12 -0700 In some webpages we are hitting the following state where we are trying to build an isolated tree branch with a starting object that has invalid/null ID. This creates undefined problems since the ID is used as the key for HashMaps. (lldb) f 7 frame #7: 0x000000014da57480 WebCore`WebCore::AXIsolatedTree::collectNodeChangesForSubtree(this=0x0000000105e2f500, axObject=0x0000000105d1d700) at AXIsolatedTree.cpp:311:32 308 AXTRACE("AXIsolatedTree::collectNodeChangesForSubtree"_s); 309 ASSERT(isMainThread()); 310 SetForScope collectingNodeChanges(m_isCollectingNodeChanges, true); -> 311 m_unresolvedPendingAppends.set(axObject.objectID(), AttachWrapper::OnMainThread); 312 313 auto axChildrenCopy = axObject.children(); 314 auto axChildrenIDs = axChildrenCopy.map([&](auto& axChild) { (lldb) v axObject.m_id (WebCore::AXID) axObject.m_id = (m_identifier = 0) 1876056 1 webkit-bug-importer 2022-06-15 12:36:20 -0700 <rdar://problem/95229695> 1876057 2 460259 andresg_22 2022-06-15 12:39:19 -0700 Created attachment 460259 Patch 1876067 3 andresg_22 2022-06-15 13:38:44 -0700 Another example where trying to remove an isolated object for a null ID: (lldb) f 8 frame #8: 0x000000014be8fc34 WebCore`WebCore::AXIsolatedTree::removeSubtreeFromNodeMap(this=0x0000000103e79300, objectID=(m_identifier = 0), axParent=0x0000000103d63d00) at AXIsolatedTree.cpp:638:20 635 AXLOG(makeString("Removing subtree for objectID ", objectID.loggingString())); 636 ASSERT(isMainThread()); 637 -> 638 if (!m_nodeMap.contains(objectID)) { 639 AXLOG(makeString("Tried to remove AXID ", objectID.loggingString(), " that is no longer in m_nodeMap.")); 640 return; 641 } (lldb) v objectID (WebCore::AXID) objectID = (m_identifier = 0) 1876077 4 460260 andresg_22 2022-06-15 14:01:55 -0700 Created attachment 460260 Patch 1876166 5 ews-feeder 2022-06-15 19:18:32 -0700 Committed r295582 (251587@main): <https://commits.webkit.org/251587@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 460260. 460259 2022-06-15 12:39:19 -0700 2022-06-15 14:01:52 -0700 Patch bug-241643-20220615153918.patch text/plain 1478 andresg_22 RnJvbSA5ZWY3MjM2ZjUzNmU3MzUxZWIyMzAwYzc0YmQyZTk1ODEwYjg4MGJkIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyZXMgR29uemFsZXogPGFuZHJlc2dfMjJAYXBwbGUuY29t PgpEYXRlOiBXZWQsIDE1IEp1biAyMDIyIDE1OjI0OjUwIC0wNDAwClN1YmplY3Q6IFtQQVRDSF0g SVRNOiBTaG91bGQgbm90IGJ1aWxkIGFuIGlzb2xhdGVkIHRyZWUgYnJhbmNoIHJvb3RlZCBhdCBh bgogb2JqZWN0IHdpdGggaW52YWxpZCBJRC4gaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTI0MTY0MwoKUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCgpBZGRlZCBjaGVj ayBmb3IgdmFsaWQgb2JqZWN0IElEIGluIEFYSXNvbGF0ZWRUcmVlOjpjb2xsZWN0Tm9kZUNoYW5n ZXNGb3JTdWJ0cmVlLgoKKiBTb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2lzb2xhdGVkdHJl ZS9BWElzb2xhdGVkVHJlZS5jcHA6CihXZWJDb3JlOjpBWElzb2xhdGVkVHJlZTo6Y29sbGVjdE5v ZGVDaGFuZ2VzRm9yU3VidHJlZSk6Ci0tLQogLi4uL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9pc29s YXRlZHRyZWUvQVhJc29sYXRlZFRyZWUuY3BwICAgfCA2ICsrKysrKwogMSBmaWxlIGNoYW5nZWQs IDYgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxp dHkvaXNvbGF0ZWR0cmVlL0FYSXNvbGF0ZWRUcmVlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vz c2liaWxpdHkvaXNvbGF0ZWR0cmVlL0FYSXNvbGF0ZWRUcmVlLmNwcAppbmRleCBmOWY3Yzc0MGQ5 ZWIuLmJiYjE4YjBlODNlNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0 eS9pc29sYXRlZHRyZWUvQVhJc29sYXRlZFRyZWUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2Fj Y2Vzc2liaWxpdHkvaXNvbGF0ZWR0cmVlL0FYSXNvbGF0ZWRUcmVlLmNwcApAQCAtMzA3LDYgKzMw NywxMiBAQCB2b2lkIEFYSXNvbGF0ZWRUcmVlOjpjb2xsZWN0Tm9kZUNoYW5nZXNGb3JTdWJ0cmVl KEFYQ29yZU9iamVjdCYgYXhPYmplY3QpCiB7CiAgICAgQVhUUkFDRSgiQVhJc29sYXRlZFRyZWU6 OmNvbGxlY3ROb2RlQ2hhbmdlc0ZvclN1YnRyZWUiX3MpOwogICAgIEFTU0VSVChpc01haW5UaHJl YWQoKSk7CisKKyAgICBpZiAoIWF4T2JqZWN0Lm9iamVjdElEKCkuaXNWYWxpZCgpKSB7CisgICAg ICAgIC8vIEJhaWwgb3V0IGhlcmUsIHdlIGNhbid0IGJ1aWxkIGFuIGlzb2xhdGVkIHRyZWUgYnJh bmNoIHJvb3RlZCBhdCBhbiBvYmplY3Qgd2l0aCBubyBJRC4KKyAgICAgICAgcmV0dXJuOworICAg IH0KKwogICAgIFNldEZvclNjb3BlIGNvbGxlY3RpbmdOb2RlQ2hhbmdlcyhtX2lzQ29sbGVjdGlu Z05vZGVDaGFuZ2VzLCB0cnVlKTsKICAgICBtX3VucmVzb2x2ZWRQZW5kaW5nQXBwZW5kcy5zZXQo YXhPYmplY3Qub2JqZWN0SUQoKSwgQXR0YWNoV3JhcHBlcjo6T25NYWluVGhyZWFkKTsKIAo= 460260 2022-06-15 14:01:55 -0700 2022-06-15 19:18:33 -0700 Patch bug-241643-20220615170154.patch text/plain 2866 andresg_22 RnJvbSA1OTJiNTUzMmZiMzVhNjc3N2Y5OGE5YjBiM2UxOTQ3NzEyYTQ4ODljIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyZXMgR29uemFsZXogPGFuZHJlc2dfMjJAYXBwbGUuY29t PgpEYXRlOiBXZWQsIDE1IEp1biAyMDIyIDE1OjI0OjUwIC0wNDAwClN1YmplY3Q6IFtQQVRDSF0g QVggSVRNOiBTaG91bGQgbm90IGJ1aWxkIGFuIGlzb2xhdGVkIHRyZWUgYnJhbmNoIHJvb3RlZCBh dCBhbgogb2JqZWN0IHdpdGggaW52YWxpZCBJRC4gU2hvdWxkIG5vdCBhdHRlbXB0IHRvIHJlbW92 ZSBhbiBvYmplY3QgZm9yIGFuIGludmFsaWQKIElELiBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MjQxNjQzCgpSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KCkFkZGVk IGNoZWNrIGZvciB2YWxpZCBvYmplY3QgSUQgaW4gQVhJc29sYXRlZFRyZWU6OmNvbGxlY3ROb2Rl Q2hhbmdlc0ZvclN1YnRyZWUgYW5kIGluIHVwZGF0ZUNoaWxkcmVuIHNpbmNlIGluIGJvdGggY2Fz ZXMgdGhlIElEIGlzIHVzZWQgYXMgYSBrZXkgZm9yIEhhc2hNYXBzIHdoaWNoIGNhbm5vdCBiZSBu dWxsLgoKKiBTb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2lzb2xhdGVkdHJlZS9BWElzb2xh dGVkVHJlZS5jcHA6CihXZWJDb3JlOjpBWElzb2xhdGVkVHJlZTo6Y29sbGVjdE5vZGVDaGFuZ2Vz Rm9yU3VidHJlZSk6CihXZWJDb3JlOjpBWElzb2xhdGVkVHJlZTo6dXBkYXRlQ2hpbGRyZW4pOgot LS0KIC4uLi9hY2Nlc3NpYmlsaXR5L2lzb2xhdGVkdHJlZS9BWElzb2xhdGVkVHJlZS5jcHAgICAg IHwgMTEgKysrKysrKysrLS0KIDEgZmlsZSBjaGFuZ2VkLCA5IGluc2VydGlvbnMoKyksIDIgZGVs ZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9pc29s YXRlZHRyZWUvQVhJc29sYXRlZFRyZWUuY3BwIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0 eS9pc29sYXRlZHRyZWUvQVhJc29sYXRlZFRyZWUuY3BwCmluZGV4IGY5ZjdjNzQwZDllYi4uNjg2 OTc0OGFmNmY1IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2lzb2xh dGVkdHJlZS9BWElzb2xhdGVkVHJlZS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJp bGl0eS9pc29sYXRlZHRyZWUvQVhJc29sYXRlZFRyZWUuY3BwCkBAIC0zMDcsNiArMzA3LDEyIEBA IHZvaWQgQVhJc29sYXRlZFRyZWU6OmNvbGxlY3ROb2RlQ2hhbmdlc0ZvclN1YnRyZWUoQVhDb3Jl T2JqZWN0JiBheE9iamVjdCkKIHsKICAgICBBWFRSQUNFKCJBWElzb2xhdGVkVHJlZTo6Y29sbGVj dE5vZGVDaGFuZ2VzRm9yU3VidHJlZSJfcyk7CiAgICAgQVNTRVJUKGlzTWFpblRocmVhZCgpKTsK KworICAgIGlmICghYXhPYmplY3Qub2JqZWN0SUQoKS5pc1ZhbGlkKCkpIHsKKyAgICAgICAgLy8g QmFpbCBvdXQgaGVyZSwgd2UgY2FuJ3QgYnVpbGQgYW4gaXNvbGF0ZWQgdHJlZSBicmFuY2ggcm9v dGVkIGF0IGFuIG9iamVjdCB3aXRoIG5vIElELgorICAgICAgICByZXR1cm47CisgICAgfQorCiAg ICAgU2V0Rm9yU2NvcGUgY29sbGVjdGluZ05vZGVDaGFuZ2VzKG1faXNDb2xsZWN0aW5nTm9kZUNo YW5nZXMsIHRydWUpOwogICAgIG1fdW5yZXNvbHZlZFBlbmRpbmdBcHBlbmRzLnNldChheE9iamVj dC5vYmplY3RJRCgpLCBBdHRhY2hXcmFwcGVyOjpPbk1haW5UaHJlYWQpOwogCkBAIC01NDUsMTMg KzU1MSwxNCBAQCB2b2lkIEFYSXNvbGF0ZWRUcmVlOjp1cGRhdGVDaGlsZHJlbihBWENvcmVPYmpl Y3QmIGF4T2JqZWN0KQogCiAgICAgLy8gV2hhdCBpcyBsZWZ0IGluIG9sZENoaWxkcmVuSURzIGFy ZSB0aGUgSURzIHRoYXQgYXJlIG5vIGxvbmdlciBjaGlsZHJlbiBvZiBheEFuY2VzdG9yLgogICAg IC8vIFRodXMsIHJlbW92ZSB0aGVtIGZyb20gbV9ub2RlTWFwIGFuZCBxdWV1ZSB0aGVtIHRvIGJl IHJlbW92ZWQgZnJvbSB0aGUgdHJlZS4KLSAgICBmb3IgKEFYSUQmIGF4SUQgOiBvbGRDaGlsZHJl bklEcykgeworICAgIGZvciAoY29uc3QgQVhJRCYgYXhJRCA6IG9sZENoaWxkcmVuSURzKSB7CiAg ICAgICAgIC8vIEhvd2V2ZXIsIHdlIGRvbid0IHdhbnQgdG8gcmVtb3ZlIHN1YnRyZWVzIGZyb20g dGhlIG5vZGVtYXAgdGhhdCBhcmUgcGFydCBvZiB0aGUgdG8tYmUtcXVldWVkIG5vZGUgY2hhbmdl cyAoaS5lIHRob3NlIGluIGBpZHNCZWluZ0NoYW5nZWRgKS4KICAgICAgICAgLy8gVGhpcyBpcyBp bXBvcnRhbnQgd2hlbiBhIG5vZGUgbW92ZXMgdG8gYSBkaWZmZXJlbnQgcGFydCBvZiB0aGUgdHJl ZSByYXRoZXIgdGhhbiBiZWluZyBkZWxldGVkIC0tIGZvciBleGFtcGxlOgogICAgICAgICAvLyAg IDEuIE9iamVjdCAxMjMgaXMgc2xhdGVkIHRvIGJlIGEgY2hpbGQgb2YgdGhpcyBvYmplY3QgKGku ZS4gaW4gbmV3Q2hpbGRyZW4pLCBhbmQgd2UgY29sbGVjdCBub2RlIGNoYW5nZXMgZm9yIGl0Lgog ICAgICAgICAvLyAgIDIuIE9iamVjdCAxMjMgaXMgY3VycmVudGx5IGEgbWVtYmVyIG9mIGEgc3Vi dHJlZSBvZiBzb21lIG90aGVyIG9iamVjdCBpbiBvbGRDaGlsZHJlbklEcy4KICAgICAgICAgLy8g ICAzLiBUaHVzLCB3ZSBkb24ndCB3YW50IHRvIGRlbGV0ZSBPYmplY3QgMTIzIGZyb20gdGhlIG5v ZGVtYXAsIGluc3RlYWQgYWxsb3dpbmcgaXQgdG8gYmUgbW92ZWQuCi0gICAgICAgIHJlbW92ZVN1 YnRyZWVGcm9tTm9kZU1hcChheElELCBheEFuY2VzdG9yKTsKKyAgICAgICAgaWYgKGF4SUQuaXNW YWxpZCgpKQorICAgICAgICAgICAgcmVtb3ZlU3VidHJlZUZyb21Ob2RlTWFwKGF4SUQsIGF4QW5j ZXN0b3IpOwogICAgIH0KICAgICBxdWV1ZVJlbW92YWxzQW5kVW5yZXNvbHZlZENoYW5nZXMob2xk Q2hpbGRyZW5JRHMpOwogCg==