In AXIsolatedTree::applyPendingChanges, we process node and subtree removals before tree additions. When doing these removals, we detach the object and wrapper from each other. This is fine unless that same object is slated to be added again (e.g. it was moved in the DOM), as we don't always re-attach a wrapper. [WebAccessibilityObjectWrapperBase axBackingObject] will always return nil for objects in this state.
<rdar://problem/88601894>
Created attachment 451175 [details] Patch
(In reply to Tyler Wilcock from comment #2) > Created attachment 451175 [details] > Patch - if (!item.isolatedObject->wrapper()) { - // The new object hasn't been attached a wrapper yet, so attach it. + // If the new object hasn't been attached to a wrapper yet, or if it was detached from + // the wrapper when processing removals above, we must attach / re-attach it. + if (!item.isolatedObject->wrapper() || detachedObjectIDs.contains(axID)) item.isolatedObject->attachPlatformWrapper(wrapper.get()); Good catch! I think though that it would be a better solution to check for whether the wrapper has an isolatedObject, and if not, attach the isolated object to the wrapper, instead of creating this new collection and looking up the AXID.
Created attachment 451204 [details] Patch
Created attachment 451206 [details] Patch
Committed r289368 (246956@main): <https://commits.webkit.org/246956@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 451206 [details].