Sometimes AXIsolatedTree::updateChildren is called with an object that is not in the isolated tree. When this happens, we currently call AXIsolatedTree::nodeAncestryChanges to build the ancestry chain up to the nearest in-isolated-tree node (starting with the original object called for updateChildren). However, this seems to result in adding nodes to the isolated tree that don't exist in the live tree. I believe this also causes isolated objects to often hold references to parent objects that don't exist in the isolated tree, breaking searches (and more).
<rdar://problem/88721439>
Created attachment 451463 [details] Patch
Created attachment 451465 [details] Patch
Created attachment 451474 [details] Patch
Created attachment 451475 [details] Patch
Created attachment 451477 [details] Patch
Committed r289537 (247068@main): <https://commits.webkit.org/247068@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 451477 [details].