Bug 41000

Summary: AX: If an element that is a continuation is removed, its parent tree is not notified appropriately that their children have changed
Product: WebKit Reporter: chris fleizach <cfleizach>
Component: AccessibilityAssignee: chris fleizach <cfleizach>
Status: RESOLVED FIXED    
Severity: Normal CC: bdakin
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
Patch darin: review+

Description chris fleizach 2010-06-22 11:06:35 PDT
If you have an element like
<a href="#"><h3>asdf</h3>adsf</a>
this causes a continuation to occur

if one of those children are removed, then its parent chain needs to be notified that an element has been removed.

however, because the child is a continuation, its direct render parent, is not the same as its accessibility parent, so the correct AX chain is not being notified

this causes VoiceOver to crash  and can lead to an ASSERT
Comment 1 chris fleizach 2010-06-22 11:25:10 PDT
Created attachment 59396 [details]
Patch
Comment 2 Darin Adler 2010-06-22 11:28:54 PDT
Comment on attachment 59396 [details]
Patch

> +    // Go up the accessibility parent chain, but only if the element already exists. Creating an AX element now can be fatal.

Is there some better way to say that than "can be fatal"? Maybe say more specifically what's bad about creating an AX element now?

> -                axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
> +                axObjectCache()->postNotification(axParent->renderer(), AXObjectCache::AXLiveRegionChanged, true);

Is axParent->renderer() guaranteed to be non-zero?

r=me
Comment 3 chris fleizach 2010-06-22 11:46:50 PDT
(In reply to comment #2)
> (From update of attachment 59396 [details])
> > +    // Go up the accessibility parent chain, but only if the element already exists. Creating an AX element now can be fatal.
> 
> Is there some better way to say that than "can be fatal"? Maybe say more specifically what's bad about creating an AX element now?
> 

Will do

> > -                axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
> > +                axObjectCache()->postNotification(axParent->renderer(), AXObjectCache::AXLiveRegionChanged, true);
> 
> Is axParent->renderer() guaranteed to be non-zero?
> 

yes, otherwise we would not have received an element back. but if a nil is passed to postNotification, there are checks in that as well

> r=me
Comment 4 chris fleizach 2010-06-22 12:02:00 PDT
http://trac.webkit.org/changeset/61622