If you have an element like <a href="#"><h3>asdf</h3>adsf</a> this causes a continuation to occur if one of those children are removed, then its parent chain needs to be notified that an element has been removed. however, because the child is a continuation, its direct render parent, is not the same as its accessibility parent, so the correct AX chain is not being notified this causes VoiceOver to crash and can lead to an ASSERT
Created attachment 59396 [details] Patch
Comment on attachment 59396 [details] Patch > + // Go up the accessibility parent chain, but only if the element already exists. Creating an AX element now can be fatal. Is there some better way to say that than "can be fatal"? Maybe say more specifically what's bad about creating an AX element now? > - axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true); > + axObjectCache()->postNotification(axParent->renderer(), AXObjectCache::AXLiveRegionChanged, true); Is axParent->renderer() guaranteed to be non-zero? r=me
(In reply to comment #2) > (From update of attachment 59396 [details]) > > + // Go up the accessibility parent chain, but only if the element already exists. Creating an AX element now can be fatal. > > Is there some better way to say that than "can be fatal"? Maybe say more specifically what's bad about creating an AX element now? > Will do > > - axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true); > > + axObjectCache()->postNotification(axParent->renderer(), AXObjectCache::AXLiveRegionChanged, true); > > Is axParent->renderer() guaranteed to be non-zero? > yes, otherwise we would not have received an element back. but if a nil is passed to postNotification, there are checks in that as well > r=me
http://trac.webkit.org/changeset/61622