Bug 208844 – AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[James Craig]

Saw this report on the A11y Slackers this morning. Filing it here. I don't have a test case yet.


"""
Running into major support issues with radio buttons that share a name attribute but exist in different shadow roots? Think encapsulated radio button components. The label for each radio is in the same shadow root as the radio.

Keyboard interaction doesn’t work as it normally would with radio buttons in Chrome, FF, or Safari. This doesn’t really surprise me, but dang, it’s bad.
In VO / Safari on macOS 10.15, navigating to the radio buttons crashes the page. This happens regardless of whether the radios are in a fieldset.
"""

[Radar WebKit Bug Importer]

<rdar://problem/60252659>

[James Craig]

"on the A11y Slackers ^channel^ this morning."
web-a11y.slack.com

Teat case:
Open https://codepen.io/mra11yx/pen/OJVzpBK or fork and open a debug mode view, in Safari, on macOS Catalina or iOS 13. 

Open VoiceOver. 

Navigate to either radio button. Safari, or the page, will crash, and only when VO is runninf.

[James Craig]

Web Inspector Debugger tab changed significantly (merged into the Sources tab) so this deos not appear to be reproducible in Safari Tech Preview or nightlies.

[James Craig]

Okay, new repro:

1. Enable Developer Menu
2. Load https://codepen.io/mra11yx/full/OJVzpBK
3. Show Inspector.
4. Select the Sources tab and show debugger, or run `debuggger` in the Web Inspector console.
5. Navigate VO back to the web page. 
6. Interact with the frame and navigate VO to the form element (right after the “fake” link). 
7. Tab to the first Radio button (Note: VO focus does not follow this visible focus)
8. Press right arrow key to change the radio button selection. 
9. WebKit crashes.

[James Craig]

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000101df7841 WebCore::Position::getInlineBoxAndOffset(WebCore::EAffinity, WebCore::TextDirection, WebCore::InlineBox*&, int&) const + 129
1   com.apple.WebCore             	0x0000000102cd901d WebCore::AXObjectCache::localCaretRectForCharacterOffset(WebCore::RenderObject*&, WebCore::CharacterOffset const&) + 413
2   com.apple.WebCore             	0x0000000102d1038c WebCore::AccessibilityRenderObject::boundsForRange(WTF::RefPtr<WebCore::Range, WTF::DumbPtrTraits<WebCore::Range> >) const + 300
3   com.apple.WebCore             	0x0000000103d16fc6 -[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:] + 9894

[chris fleizach]

Created attachment 393780 [details]
patch

[WebKit Commit Bot]

Comment on attachment 393780 [details]
patch

Clearing flags on attachment: 393780

Committed r258609: <https://trac.webkit.org/changeset/258609>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.