Bug 208844 - AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.
Summary: AX: WebKit crashes with VO and keyboard support fails on encapsulated radio b...
Alias: None
Product: WebKit
Classification: Unclassified
Component: Accessibility (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Normal
Assignee: chris fleizach
Keywords: InRadar
Depends on:
Reported: 2020-03-09 17:49 PDT by James Craig
Modified: 2020-03-17 16:02 PDT (History)
14 users (show)

See Also:

patch (4.62 KB, patch)
2020-03-17 12:59 PDT, chris fleizach
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description James Craig 2020-03-09 17:49:25 PDT
Saw this report on the A11y Slackers this morning. Filing it here. I don't have a test case yet.

Running into major support issues with radio buttons that share a name attribute but exist in different shadow roots? Think encapsulated radio button components. The label for each radio is in the same shadow root as the radio.

Keyboard interaction doesn’t work as it normally would with radio buttons in Chrome, FF, or Safari. This doesn’t really surprise me, but dang, it’s bad.
In VO / Safari on macOS 10.15, navigating to the radio buttons crashes the page. This happens regardless of whether the radios are in a fieldset.
Comment 1 Radar WebKit Bug Importer 2020-03-09 17:49:34 PDT
Comment 2 James Craig 2020-03-09 18:18:20 PDT
"on the A11y Slackers ^channel^ this morning."
Comment 3 awumstead 2020-03-09 18:41:42 PDT
Teat case:
Open https://codepen.io/mra11yx/pen/OJVzpBK or fork and open a debug mode view, in Safari, on macOS Catalina or iOS 13. 

Open VoiceOver. 

Navigate to either radio button. Safari, or the page, will crash, and only when VO is runninf.
Comment 4 James Craig 2020-03-16 18:15:55 PDT
Web Inspector Debugger tab changed significantly (merged into the Sources tab) so this deos not appear to be reproducible in Safari Tech Preview or nightlies.
Comment 5 James Craig 2020-03-16 18:21:50 PDT
Okay, new repro:

1. Enable Developer Menu
2. Load https://codepen.io/mra11yx/full/OJVzpBK
3. Show Inspector.
4. Select the Sources tab and show debugger, or run `debuggger` in the Web Inspector console.
5. Navigate VO back to the web page. 
6. Interact with the frame and navigate VO to the form element (right after the “fake” link). 
7. Tab to the first Radio button (Note: VO focus does not follow this visible focus)
8. Press right arrow key to change the radio button selection. 
9. WebKit crashes.
Comment 6 James Craig 2020-03-16 18:24:35 PDT
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000101df7841 WebCore::Position::getInlineBoxAndOffset(WebCore::EAffinity, WebCore::TextDirection, WebCore::InlineBox*&, int&) const + 129
1   com.apple.WebCore             	0x0000000102cd901d WebCore::AXObjectCache::localCaretRectForCharacterOffset(WebCore::RenderObject*&, WebCore::CharacterOffset const&) + 413
2   com.apple.WebCore             	0x0000000102d1038c WebCore::AccessibilityRenderObject::boundsForRange(WTF::RefPtr<WebCore::Range, WTF::DumbPtrTraits<WebCore::Range> >) const + 300
3   com.apple.WebCore             	0x0000000103d16fc6 -[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:] + 9894
Comment 7 chris fleizach 2020-03-17 12:59:16 PDT
Created attachment 393780 [details]
Comment 8 WebKit Commit Bot 2020-03-17 16:02:41 PDT
Comment on attachment 393780 [details]

Clearing flags on attachment: 393780

Committed r258609: <https://trac.webkit.org/changeset/258609>
Comment 9 WebKit Commit Bot 2020-03-17 16:02:42 PDT
All reviewed patches have been landed.  Closing bug.