Bug 248451 – AX: AXIsolatedObject::m_childrenIDs is cleared too early when processing AXIsolatedTree::m_pendingSubtreeRemovals

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[Tyler Wilcock]

In AXIsolatedTree::applyPendingChanges(), when processing m_pendingSubtreeRemovals, we start by taking the last axID in the Vector and using it to get the associated nodeForID(). Then we call AXCoreObject::detach(AccessibilityDetachmentType::ElementDestroyed), which in turn calls AXIsolatedObject::detachRemoteParts. Currently, the implementation of this function loops over m_childrenIDs and detaches those children from `this`, and then clears m_childrenIDs.

Then, we jump back to AXIsolatedTree::applyPendingChanges() and run this line of code:

m_pendingSubtreeRemovals.appendVector(object->m_childrenIDs);

Which does nothing because we cleared m_childrenIDs as part of detachRemoteParts.

[Radar WebKit Bug Importer]

<rdar://problem/102743478>

[Tyler Wilcock]

Created attachment 463777 [details]
Patch

[EWS]

Committed 257217@main (b095a6aaca26): <https://commits.webkit.org/257217@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 463777 [details].