287716 2025-02-14 10:51:16 -0800 AX: performDeferredCacheUpdate needs to check document.hasPendingStyleRecalc 2025-02-24 12:08:18 -0800 1 1 1 Unclassified WebKit Accessibility WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 dm_mazzoni dm_mazzoni andresg_22 webkit-bug-importer oldest_to_newest 2094823 0 dm_mazzoni 2025-02-14 10:51:16 -0800 When AXObjectCache::performDeferredCacheUpdate is called, it checks to see if the document needs layout first before updating the accessibility tree. If this isn't done, walking the accessibility tree can trigger a layout in the middle, leading to inconsistencies and crashes. I discovered this while debugging this ARIA example. I can trigger a crash using VoiceOver, but the repro steps are quite tricky and I didn't have any luck turning it into a layout test. https://www.w3.org/WAI/ARIA/apg/patterns/combobox/examples/combobox-select-only/ The underlying issue was that the listbox was changing from display:none to display:block, but under some circumstances it was possible for AXObjectCache::performDeferredCacheUpdate to get called when style is dirty but needsLayout still returns false, so it wouldn't update layout, and that would lead to the listbox options getting created with the wrong parent id. VoiceOver wouldn't speak them, and in debug mode we'd get an assertion failure. I did write a layout test that successfully triggers this scenario, however it also triggers a separate unrelated assertion failure so I can't merge it yet. I filed a separate bug for that one: https://bugs.webkit.org/show_bug.cgi?id=287715 (AX: attached layout test triggers assertion in AXIsolatedObject::children) 2094825 1 webkit-bug-importer 2025-02-14 10:53:21 -0800 <rdar://problem/144875397> 2094826 2 dm_mazzoni 2025-02-14 10:57:49 -0800 Pull request: https://github.com/WebKit/WebKit/pull/40631 2097443 3 ews-feeder 2025-02-24 12:08:15 -0800 Committed 290961@main (f4ed96d58ea8): <https://commits.webkit.org/290961@main> Reviewed commits have been landed. Closing PR #40631 and removing active labels.