RESOLVED FIXED315380
AX: detach displaced wrapper in AccessibilityScrollView::addLocalFrameChild 
https://bugs.webkit.org/show_bug.cgi?id=315380
Summary AX: detach displaced wrapper in AccessibilityScrollView::addLocalFrameChild
Dawn Morningstar
Reported 2026-05-22 12:47:27 PDT
AccessibilityScrollView::addLocalFrameChild creates a fresh AXLocalFrame via AXObjectCache::create() The very next line replaces that wrapper via setWrapperFrom(*frameRoot), which drops the displaced wrapper's last RetainPtr without detaching it first.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2026-05-22 12:47:34 PDT
<rdar://problem/177734602>
Dawn Morningstar
Comment 2 2026-05-22 12:48:57 PDT
Pull request: https://github.com/WebKit/WebKit/pull/65500
EWS
Comment 3 2026-05-26 14:45:42 PDT
Committed 313915@main (fda73668c666): <https://commits.webkit.org/313915@main> Reviewed commits have been landed. Closing PR #65500 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.