Bug 273720

Summary: AX: WebPageProxy::bindRemoteAccessibilityFrames synchronously returns a std::span<uint8_t>, which is not safe
Product: WebKit Reporter: chris fleizach <cfleizach>
Component: AccessibilityAssignee: chris fleizach <cfleizach>
Status: RESOLVED FIXED    
Severity: Normal CC: aboxhall, andresg_22, apinheiro, dmazzoni, ews-watchlist, jcraig, samuel_white, tyler_w, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch
none
Patch
none
Patch none

chris fleizach
Reported 2024-05-03 17:23:22 PDT
We need to use WTMove when we're moving variables out of the binding stage
Attachments
Patch (1.24 KB, patch)
2024-05-03 17:25 PDT, chris fleizach 		no flags
DetailsFormatted DiffDiff
Patch (17.92 KB, patch)
2024-05-07 14:10 PDT, Tyler Wilcock 		no flags
DetailsFormatted DiffDiff
Patch (17.92 KB, patch)
2024-05-07 20:25 PDT, Tyler Wilcock 		no flags
DetailsFormatted DiffDiff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-05-03 17:23:36 PDT
<rdar://problem/127520479>
chris fleizach
Comment 2 2024-05-03 17:25:05 PDT
Created attachment 471277 [details] Patch
Andres Gonzalez
Comment 3 2024-05-06 08:55:52 PDT
(In reply to chris fleizach from comment #2) > Created attachment 471277 [details] > Patch I think the root of the problem is in: AXRemoteFrame::generateRemoteToken which should return NSData *data = [NSAccessibilityRemoteUIElement remoteTokenForLocalUIElement:parent->wrapper()]; Then AccessibilityScrollView::addRemoteFrameChild can retain the token: #if PLATFORM(MAC) // Generate a new token and pass it back to the other remote frame so it can bind these objects together. RetainPtr generatedToken = m_remoteFrame->generateRemoteToken();
Tyler Wilcock
Comment 4 2024-05-07 14:10:31 PDT
Created attachment 471303 [details] Patch
Tyler Wilcock
Comment 5 2024-05-07 20:24:26 PDT
rdar://125160477
Tyler Wilcock
Comment 6 2024-05-07 20:25:43 PDT
Created attachment 471310 [details] Patch
EWS
Comment 7 2024-05-08 07:19:35 PDT
Committed 278507@main (a3d84e225962): <https://commits.webkit.org/278507@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 471310 [details].
Note You need to log in before you can comment on or make changes to this bug.