This child is represented in the DOM, so there's no reason to also insert it in AccessibilityRenderObject::addTextFieldChildren. This results in duplicate objects for this button in the AX tree. When the autofill button is created, it results in this markup: <div pseudo="-webkit-textfield-decoration-container"> <div> <div contenteditable="plaintext-only">hello</div> </div> <div pseudo="-webkit-contacts-auto-fill-button" role="button" aria-label="contact info AutoFill" style="display: block !important;"></div> </div> Given this: ``` <input type="text" value="hello" id="textfield"> window.internals.setShowAutoFillButton(document.getElementById("textfield"), "Contacts"); ``` Then accessibilityController.accessibleElementById('textfield').childrenCount should be 2 (on non-glib platforms). But it is three. And if we look at what those three are, the first two are expected, and the last is a redundant button object: Child 0: AXRole: AXGroup AXRoleDescription: group AXSize: NSSize: {114, 13} AXDescription: Child 1: AXRole: AXButton AXRoleDescription: button AXSize: NSSize: {23, 13} AXDescription: contact info AutoFill Child 2: AXRole: AXButton AXRoleDescription: button AXSize: NSSize: {23, 13} AXDescription: contact info AutoFill
<rdar://problem/84474441>
Created attachment 441921 [details] Patch
cc cgarcia@igalia.com because I'm modifying some glib expectations and they've been doing GTK AX work recently.
Comment on attachment 441921 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=441921&action=review > Source/WebCore/ChangeLog:34 > + Child 0: this might be a little too in depth for change log. can you summarize these changes a little more succinctly
(In reply to Tyler Wilcock from comment #2) > Created attachment 441921 [details] > Patch --- a/LayoutTests/accessibility/auto-fill-crash.html +++ a/LayoutTests/accessibility/auto-fill-crash.html - var childrenCountExpected = accessibilityController.platformName == "atk" ? "2" : "3"; + var childrenCountExpected = accessibilityController.platformName == "atk" ? "1" : "2"; Isn't ATK doing it wright and getting 2 children here?
Created attachment 441932 [details] Patch
Created attachment 441935 [details] Patch
> this might be a little too in depth for change log. can you summarize these changes a little more succinctly Done. >Isn't ATK doing it wright and getting 2 children here? I would think ATK would expect one less too since we're inserting one less thing into the tree.
Committed r284612 (243339@main): <https://commits.webkit.org/243339@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 441935 [details].