311114 2026-03-30 09:32:23 -0700 AX: ASSERTION FAILED on AXIsolatedTree.cpp:249 when running http/tests/site-isolation/accessibility/client/simple-iframe.html 2026-04-08 15:38:36 -0700 1 1 1 Unclassified WebKit Accessibility WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 dm_mazzoni dm_mazzoni andresg_22 webkit-bug-importer oldest_to_newest 2195194 0 dm_mazzoni 2026-03-30 09:32:23 -0700 I intermittently hit this assertion failure when running http/tests/site-isolation/accessibility/client/simple-iframe.html, which tests accessibility with site isolation. By fiddling with the test timing I was able to reproduce it reliably. ASSERTION FAILED: AX: After applying pending root node, 15 reachable nodes but 17 are in the node map reachableNodes.size() == m_readerThreadNodeMap.size() /Volumes/Code/safari/OpenSource/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp(249) : void WebCore::AXIsolatedTree::applyPendingRootNodeLocked() 1 WebCore::AXIsolatedTree::applyPendingRootNodeLocked() 2 WebCore::AXIsolatedTree::applyPendingChangesLocked() 3 WebCore::AXIsolatedTree::applyPendingChanges() The bug happens when the in-process FrameHost (AccessibilityScrollView) is replaced with the out-of-process FrameHost, and then the FrameHost ends up in both m_pendingSubtreeRemovals and m_pendingAppends in applyPendingChangesLocked. We never hit this before because it doesn't happen with DOM nodes or LayoutObjects - if the old object was removed from the AX cache, then it won't end up in m_pendingAppends. In this case both the old Widget and the new Widget exist, so the assertion is telling us we're leaking the old isolated objects. With this fix, http/tests/site-isolation/accessibility/client/simple-iframe.html can be enabled. 2195195 1 webkit-bug-importer 2026-03-30 09:32:30 -0700 <rdar://problem/173698630> 2195208 2 dm_mazzoni 2026-03-30 10:26:39 -0700 Pull request: https://github.com/WebKit/WebKit/pull/61704 2198129 3 ews-feeder 2026-04-08 15:38:35 -0700 Committed 310800@main (8c8159f34720): <https://commits.webkit.org/310800@main> Reviewed commits have been landed. Closing PR #61704 and removing active labels.