Bug 315380

Summary:	AX: detach displaced wrapper in AccessibilityScrollView::addLocalFrameChild
Product:	WebKit	Reporter:	Dawn Morningstar <Morningstar>
Component:	New Bugs	Assignee:	Dawn Morningstar <Morningstar>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Dawn Morningstar

Reported 2026-05-22 12:47:27 PDT

AccessibilityScrollView::addLocalFrameChild creates a fresh AXLocalFrame via AXObjectCache::create() The very next line replaces that wrapper via setWrapperFrom(*frameRoot), which drops the displaced wrapper's last RetainPtr without detaching it first.

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2026-05-22 12:47:34 PDT

<rdar://problem/177734602>

Dawn Morningstar

Comment 2 2026-05-22 12:48:57 PDT

Pull request: https://github.com/WebKit/WebKit/pull/65500

EWS

Comment 3 2026-05-26 14:45:42 PDT

Committed 313915@main (fda73668c666): <https://commits.webkit.org/313915@main> Reviewed commits have been landed. Closing PR #65500 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.