Bug 250126 – RELEASE_ASSERT_NOT_REACHED in AccessibilityObjectAtspi::role() with MathML scripts

• Component: Accessibility
• Status: RESOLVED FIXED

[Frédéric Wang (:fredw)]

Created attachment 464346 [details]
Reduced testcase

Original repro: Open https://www.mathjax.org/#samples and click the select element to change the rendering mode.

Attached is a testcase reduced with the help of lithium, which involves munder/mover/munderover elements.

We are reaching the following assert:

https://searchfox.org/wubkat/source/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp#393

Per https://w3c.github.io/mathml-aam/ AccessibilityObjectAtspi::effectiveRole() should return Atspi::Role::Section for isMathUnderOver().

Here is a simple fix:

diff --git a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
index 0a869b206589..afaf6b9b0fb7 100644
--- a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
+++ b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
@@ -1225,7 +1225,7 @@ std::optional<unsigned> AccessibilityObjectAtspi::effectiveRole() const
             return Atspi::Role::TableRow;
         if (m_coreObject->isMathTableCell())
             return Atspi::Role::TableCell;
-        if (m_coreObject->isMathSubscriptSuperscript() || m_coreObject->isMathMultiscript())
+        if (m_coreObject->isMathUnderOver() || m_coreObject->isMathSubscriptSuperscript() || m_coreObject->isMathMultiscript())
             return Atspi::Role::Section;
         if (m_coreObject->isMathFraction())
             return Atspi::Role::MathFraction;

[Radar WebKit Bug Importer]

<rdar://problem/103909843>

[Frédéric Wang (:fredw)]

Pull request: https://github.com/WebKit/WebKit/pull/8234

[EWS]

Committed 258971@main (c7e23e3505d3): <https://commits.webkit.org/258971@main>

Reviewed commits have been landed. Closing PR #8234 and removing active labels.