299092 2025-09-18 07:42:54 -0700 [GLIB] [Debug] ASSERT error in accessibility/aria-flowto.html 2026-04-23 03:53:17 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=304211 InRadar P2 Normal --- 1 dpino aperez bugs-noreply lmoura webkit-bug-importer zimmermann oldest_to_newest 2143971 0 dpino 2025-09-18 07:42:54 -0700 The following A11y tests are crashing in GLIB ports due to an failing ASSERT: accessibility/aria-flowto.html accessibility/aria-selected.html accessibility/display-contents/element-roles.html accessibility/display-contents/list.html accessibility/display-contents/table-dynamic.html accessibility/display-contents/tree-and-treeitems.html accessibility/node-only-object-aria-owns-hang.html accessibility/node-only-object-element-rect.html accessibility/url-test.html Crash log: https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/299805@main%20(17114)/accessibility/aria-flowto-crash-log.txt Thread 1 (Thread 0x7f0b7d503c80 (LWP 973275)): #0 WTFCrash () at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WTF/wtf/Assertions.cpp:382 #1 0x00007f0ba3178b62 in WTFCrashWithInfo () at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Assertions.h:980 #2 0x00007f0ba8fe7899 in WebCore::AXCoreObject::verifyChildrenIndexInParent (this=0x7f0b7329d080, children=...) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AXCoreObject.cpp:369 #3 0x00007f0ba900b103 in WebCore::AccessibilityObject::verifyChildrenIndexInParent (this=0x7f0b7329d080) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/WebKitBuild/GTK/Debug/WebCore/PrivateHeaders/WebCore/AccessibilityObject.h:945 #4 0x00007f0ba90d9890 in operator() (__closure=0x7ffddfc07cf0) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityRenderObject.cpp:2862 #5 0x00007f0ba90ed720 in WTF::ScopeExit<WebCore::AccessibilityRenderObject::addChildren()::<lambda()> >::~ScopeExit(void) (this=0x7ffddfc07cf0, __in_chrg=<optimized out>) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/WebKitBuild/GTK/Debug/WTF/Headers/wtf/Scope.h:53 #6 0x00007f0ba90da052 in WebCore::AccessibilityRenderObject::addChildren (this=0x7f0b7329d080) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityRenderObject.cpp:2990 #7 0x00007f0ba90c2383 in WebCore::AccessibilityObject::updateChildrenIfNecessary (this=0x7f0b7329d080) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityObject.cpp:2223 #8 0x00007f0ba90a4a3b in WebCore::AccessibilityNodeObject::updateChildrenIfNecessary (this=0x7f0b7329d080) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityNodeObject.cpp:729 #9 0x00007f0ba900c942 in WebCore::AccessibilityObject::children (this=0x7f0b7329d080, updateChildrenIfNeeded=true) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityObjectInlines.h:252 #10 0x00007f0ba90bb212 in WebCore::AccessibilityObject::insertChild (this=0x7f0b7329d300, child=..., index=0, descendIfIgnored=WebCore::AccessibilityObject::DescendIfIgnored::Yes) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityObject.cpp:678 #11 0x00007f0ba90933bf in WebCore::AccessibilityObject::addChild (this=0x7f0b7329d300, object=..., descend=WebCore::AccessibilityObject::DescendIfIgnored::Yes) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/WebKitBuild/GTK/Debug/WebCore/PrivateHeaders/WebCore/AccessibilityObject.h:563 #12 0x00007f0ba90d9935 in operator() (__closure=0x7ffddfc07ec8, object=...) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityRenderObject.cpp:2880 #13 0x00007f0ba90d9da3 in WebCore::AccessibilityRenderObject::addChildren (this=0x7f0b7329d300) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityRenderObject.cpp:2957 #14 0x00007f0ba90c2383 in WebCore::AccessibilityObject::updateChildrenIfNecessary (this=0x7f0b7329d300) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityObject.cpp:2223 #15 0x00007f0ba90a4a3b in WebCore::AccessibilityNodeObject::updateChildrenIfNecessary (this=0x7f0b7329d300) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityNodeObject.cpp:729 #16 0x00007f0ba900c942 in WebCore::AccessibilityObject::children (this=0x7f0b7329d300, updateChildrenIfNeeded=true) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityObjectInlines.h:252 #17 0x00007f0ba90bb212 in WebCore::AccessibilityObject::insertChild (this=0x7f0b7329cae0, child=..., index=0, descendIfIgnored=WebCore::AccessibilityObject::DescendIfIgnored::Yes) at /home/buildbot-worker/GTK-Linux-64-bit-Debug-Build/build/Source/WebCore/accessibility/AccessibilityObject.cpp:678 Basically, the condition validated in `verifyChildrenIndexInParent` is not met: ```cpp for (unsigned i = 0; i < children.size(); i++) ASSERT(children[i]->indexInParent() == i); ``` I think it has to do with the fact that ATSPI still has its own code path for building the the A11y tree. 2166017 1 lmoura 2025-12-15 14:31:30 -0800 This is also affecting accessibility/non-data-table-cell-title-ui-element.html (constant) For WPE-Debug, according to webkit-testhunter: 300387@main NOERROR 300411@main CRASH (Expected: PASS) And for GTK-Debug: 289992@main NOERROR 300390@main CRASH (Expected: PASS) Although this NOERROR might be due to the test not being run, as I could not find it in the full_results for the good revision. Interestingly, we're also getting this as a flaky debug crash for the following test: imported/w3c/web-platform-tests/css/css-display/parsing/display-computed.html 2166341 2 zimmermann 2025-12-16 13:28:51 -0800 Same flaky debug crash backtrace seen here: https://build.webkit.org/results/GTK-Linux-64-bit-Debug-Tests/304475@main%20(17735)/imported/w3c/web-platform-tests/css/css-display/focus/display-contents-focus-crash-log.txt 2166404 3 zimmermann 2025-12-16 14:42:42 -0800 Gardened imported/w3c/web-platform-tests/css/css-display/focus/display-contents-focus.htm in https://commits.webkit.org/304545@main. 2201813 4 csaavedra 2026-04-18 01:02:01 -0700 Pull request: https://github.com/WebKit/WebKit/pull/63036 2201857 5 ews-feeder 2026-04-18 08:45:18 -0700 Committed 311528@main (86601950f4eb): <https://commits.webkit.org/311528@main> Reviewed commits have been landed. Closing PR #63036 and removing active labels. 2201858 6 webkit-bug-importer 2026-04-18 08:46:13 -0700 <rdar://problem/175080448> 2202203 7 aperez 2026-04-20 04:51:17 -0700 Re-opening for pull request https://github.com/WebKit/WebKit/pull/63113 2203644 8 ews-feeder 2026-04-23 03:53:13 -0700 Committed 305877.450@webkitglib/2.52 (431223a131a7): <https://commits.webkit.org/305877.450@webkitglib/2.52> Reviewed commits have been landed. Closing PR #63113 and removing active labels.