tree 0044be56fd678e73cdcade34126cd1afba5a363e
parent 2225fea7f3edbb57ae01126ce7e8d25e55a6f9f5
author tyler_w@apple.com <tyler_w@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1655425266 +0000
committer tyler_w@apple.com <tyler_w@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1655425266 +0000

AX: AccessibilityObject::insertChild does not check the validity of the insertionIndex while processing grandchildren
https://bugs.webkit.org/show_bug.cgi?id=241650

Reviewed by Chris Fleizach.

When AccessibilityObject::insertChild is asked to insert a child that's
ignored, we instead add that object's children. However, both
`accessibilityIsIgnored` and `children` can cause layout, and said
layout could cause AccessibilityObject::m_children to be cleared. This
makes the `insertionIndex` invalid, which causes a crash.

In this patch, right before m_children.insert(), we check to make sure
the index is still valid.

I wasn't able to make a test for this bug. It is difficult to reproduce,
and the circumstances to reproduce are complex.

* Source/WebCore/accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::insertChild):

Canonical link: https://commits.webkit.org/251623@main


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@295618 268f45cc-cd09-0410-ab3c-d52691b4dbfc