Bug 273720 – AX: WebPageProxy::bindRemoteAccessibilityFrames synchronously returns a std::span<uint8_t>, which is not safe

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[chris fleizach]

We need to use WTMove when we're moving variables out of the binding stage

[Radar WebKit Bug Importer]

<rdar://problem/127520479>

[chris fleizach]

Created attachment 471277 [details]
Patch

[Andres Gonzalez]

(In reply to chris fleizach from comment #2)
> Created attachment 471277 [details]
> Patch

I think the root of the problem is in:

AXRemoteFrame::generateRemoteToken

which should return 

        NSData *data = [NSAccessibilityRemoteUIElement remoteTokenForLocalUIElement:parent->wrapper()];


Then AccessibilityScrollView::addRemoteFrameChild can retain the token:

#if PLATFORM(MAC)
        // Generate a new token and pass it back to the other remote frame so it can bind these objects together.
        RetainPtr generatedToken = m_remoteFrame->generateRemoteToken();

[Tyler Wilcock]

Created attachment 471303 [details]
Patch

[Tyler Wilcock]

rdar://125160477

[Tyler Wilcock]

Created attachment 471310 [details]
Patch

[EWS]

Committed 278507@main (a3d84e225962): <https://commits.webkit.org/278507@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 471310 [details].