From 4ef6169e54ce65e7b1a213c7917a9ee69baf0e75 Mon Sep 17 00:00:00 2001
From: Andres Gonzalez <andresg_22@apple.com>
Date: Fri, 12 Jan 2024 17:13:16 -0800
Subject: [PATCH] AX: Refactor the TitleUIElement property using LabeledBy and
 LabelFor relationships. https://bugs.webkit.org/show_bug.cgi?id=262787
 <rdar://problem/116581948>

Reviewed by Tyler Wilcock.

The TitleUIElement property was treated as being independent from the object's LabeledBy and LabelFor relationships. Conceptually, TitleUIElement and LabeledBy are the same concept, and indeed shared a lot of common code in the AccessibilityObject class hierarchy. This change unifies the implementation of TitleUIElement and the Label relationships in a coherent way.

With this change is no longer necessary to cache and update the TitleUIElement in the IsolatedObject as a separate property, but instead it is stored as a relationship. This change will also allow the addition of enhanced heuristics to determine label-object associations.

Some code and style cleanup is also part of the patch.

Canonical link: https://commits.webkit.org/273000@main
---
 ...-hidden-negates-no-visibility-expected.txt |   2 +-
 ...-labelledby-on-password-input-expected.txt |   8 +-
 .../aria-labelledby-on-password-input.html    |  11 +-
 .../aria-labelledby-text-expected.txt         |  10 +-
 .../accessibility/aria-labelledby-text.html   |  12 +-
 ...-label-overrides-visible-text-expected.txt |   2 +-
 .../aria-label-overrides-visible-text.html    |   2 +-
 .../radio-button-title-label-expected.txt     |   4 +-
 .../radio-button-title-label.html             |   4 +-
 .../accessibility/th-as-title-ui-expected.txt |   3 -
 LayoutTests/accessibility/th-as-title-ui.html |  42 --
 LayoutTests/platform/glib/TestExpectations    |   1 -
 ...belledby-overrides-aria-label-expected.txt |   6 +-
 .../aria-switch-text-expected.txt             |   2 +-
 .../w3c-svg-name-calculation-expected.txt     |  12 +-
 Source/WebCore/accessibility/AXCoreObject.cpp |  12 +
 Source/WebCore/accessibility/AXCoreObject.h   |   8 +-
 Source/WebCore/accessibility/AXLogger.cpp     |  10 +-
 .../WebCore/accessibility/AXObjectCache.cpp   | 225 +++++++----
 Source/WebCore/accessibility/AXObjectCache.h  |  10 +-
 .../accessibility/AccessibilityLabel.cpp      |  27 --
 .../accessibility/AccessibilityLabel.h        |   8 +-
 .../accessibility/AccessibilityNodeObject.cpp | 368 +++++++++---------
 .../accessibility/AccessibilityNodeObject.h   |  19 +-
 .../accessibility/AccessibilityObject.cpp     |   9 +-
 .../accessibility/AccessibilityObject.h       |   7 +-
 .../AccessibilityProgressIndicator.cpp        |   2 +-
 .../AccessibilityRenderObject.cpp             |  15 +-
 .../accessibility/AccessibilityRenderObject.h |   4 +-
 .../accessibility/AccessibilityTable.cpp      |   2 +-
 .../accessibility/AccessibilityTable.h        |   2 +-
 .../atspi/AccessibilityObjectAtspi.cpp        |  20 +-
 .../ios/WebAccessibilityObjectWrapperIOS.mm   |  17 +-
 .../isolatedtree/AXIsolatedObject.cpp         |  13 -
 .../isolatedtree/AXIsolatedObject.h           |   3 -
 .../isolatedtree/AXIsolatedTree.cpp           |  40 +-
 .../isolatedtree/AXIsolatedTree.h             |   4 +-
 .../mac/WebAccessibilityObjectWrapperMac.mm   |   3 +-
 38 files changed, 484 insertions(+), 465 deletions(-)
 delete mode 100644 LayoutTests/accessibility/th-as-title-ui-expected.txt
 delete mode 100644 LayoutTests/accessibility/th-as-title-ui.html

diff --git a/LayoutTests/accessibility/aria-hidden-negates-no-visibility-expected.txt b/LayoutTests/accessibility/aria-hidden-negates-no-visibility-expected.txt
index 3ef5f69dc930..fb76acc041e4 100644
--- a/LayoutTests/accessibility/aria-hidden-negates-no-visibility-expected.txt
+++ b/LayoutTests/accessibility/aria-hidden-negates-no-visibility-expected.txt
@@ -16,7 +16,7 @@ PASS heading3.role is 'AXRole: AXHeading'
 PASS parent.childAtIndex(1).isEqual(heading3) is true
 PASS heading4.role is 'AXRole: AXHeading'
 PASS parent.childAtIndex(2).isEqual(heading4) is true
-Textfield Title: AXTitle:
+Textfield Title: AXTitle: HiddenText1
 PASS !video || video.childrenCount == 0 is true
 PASS successfullyParsed is true
 
diff --git a/LayoutTests/accessibility/aria-labelledby-on-password-input-expected.txt b/LayoutTests/accessibility/aria-labelledby-on-password-input-expected.txt
index b92f2e7dcc11..3bc2469f7a96 100644
--- a/LayoutTests/accessibility/aria-labelledby-on-password-input-expected.txt
+++ b/LayoutTests/accessibility/aria-labelledby-on-password-input-expected.txt
@@ -1,15 +1,15 @@
 This test ensures a label from aria-labelledby does not include a password inputs value.
 
 PASS: button1.description === 'AXDescription: '
-PASS: button1.title === 'AXTitle: Button One'
-PASS: button1.description === 'AXDescription: •••••'
 PASS: button1.title === 'AXTitle: '
+PASS: button1.description === 'AXDescription: •••••'
+PASS: button1.title === 'AXTitle: •••••'
 Update aria-labelledby to text-1 for #button-2
 PASS: button2.description === 'AXDescription: Before password After password'
-PASS: button2.title === 'AXTitle: '
+PASS: button2.title === 'AXTitle: Before password After password'
 Update value for #password-2
 PASS: button2.description === 'AXDescription: Before password ••••• After password'
-PASS: button2.title === 'AXTitle: '
+PASS: button2.title === 'AXTitle: Before password ••••• After password'
 
 PASS successfullyParsed is true
 
diff --git a/LayoutTests/accessibility/aria-labelledby-on-password-input.html b/LayoutTests/accessibility/aria-labelledby-on-password-input.html
index 8a3dd2220e85..62cd47a05205 100644
--- a/LayoutTests/accessibility/aria-labelledby-on-password-input.html
+++ b/LayoutTests/accessibility/aria-labelledby-on-password-input.html
@@ -5,6 +5,7 @@
 <script src="../resources/js-test.js"></script>
 </head>
 <body>
+
 <div>
     <button id="button-1" aria-labelledby="password-1">Button One</button>
     <button id="button-2">Button Two</button>
@@ -22,19 +23,19 @@
     var password1 = accessibilityController.accessibleElementById("password-1");
     var password2 = accessibilityController.accessibleElementById("password-2");
     output += expect("button1.description", "'AXDescription: '");
-    output += expect("button1.title", "'AXTitle: Button One'");
+    output += expect("button1.title", "'AXTitle: '");
 
     document.getElementById("password-1").value = "hello";
     setTimeout(async function() {
         await waitFor(() => password1.stringValue === "AXValue: \u2022\u2022\u2022\u2022\u2022");
         output += expect("button1.description", "'AXDescription: \u2022\u2022\u2022\u2022\u2022'");
-        output += expect("button1.title", "'AXTitle: '");
+        output += expect("button1.title", "'AXTitle: \u2022\u2022\u2022\u2022\u2022'");
 
         output += "Update aria-labelledby to text-1 for #button-2\n";
         document.getElementById("button-2").setAttribute("aria-labelledby", "text-1");
         await waitFor(() => button2.description === "AXDescription: Before password After password");
         output += expect("button2.description", "'AXDescription: Before password After password'");
-        output += expect("button2.title", "'AXTitle: '");
+        output += expect("button2.title", "'AXTitle: Before password After password'");
 
         output += "Update value for #password-2\n";
         document.getElementById("password-2").value = "hello";
@@ -43,7 +44,7 @@
                 && button2.description === "AXDescription: Before password \u2022\u2022\u2022\u2022\u2022 After password";
         });
         output += expect("button2.description", "'AXDescription: Before password \u2022\u2022\u2022\u2022\u2022 After password'");
-        output += expect("button2.title", "'AXTitle: '");
+        output += expect("button2.title", "'AXTitle: Before password \u2022\u2022\u2022\u2022\u2022 After password'");
 
         debug(output);
         finishJSTest();
@@ -51,4 +52,4 @@
 }
 </script>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/LayoutTests/accessibility/aria-labelledby-text-expected.txt b/LayoutTests/accessibility/aria-labelledby-text-expected.txt
index 186f126b4fa3..a8d053a3db52 100644
--- a/LayoutTests/accessibility/aria-labelledby-text-expected.txt
+++ b/LayoutTests/accessibility/aria-labelledby-text-expected.txt
@@ -1,17 +1,15 @@
 This test ensures that aria-labelledby elements return the right AXDescription when their labels are updated.
 
 PASS: button1.description === 'AXDescription: Label for Button One'
-PASS: button1.title === 'AXTitle: '
+PASS: button1.title === 'AXTitle: Label for Button One'
 PASS: button2.description === 'AXDescription: '
 PASS: button2.description === 'AXDescription: Label for Button Two'
-PASS: button2.title === 'AXTitle: '
+PASS: button2.title === 'AXTitle: Label for Button Two'
 PASS: button1.description === 'AXDescription: Label for Button One!'
-PASS: button1.title === 'AXTitle: '
+PASS: button1.title === 'AXTitle: Label for Button One!'
 
 PASS successfullyParsed is true
 
 TEST COMPLETE
-Button One  Button Two
-Label for Button One!
 
-Label for Button Two
+
diff --git a/LayoutTests/accessibility/aria-labelledby-text.html b/LayoutTests/accessibility/aria-labelledby-text.html
index 8663d1579912..2f92a4d7613e 100644
--- a/LayoutTests/accessibility/aria-labelledby-text.html
+++ b/LayoutTests/accessibility/aria-labelledby-text.html
@@ -5,7 +5,8 @@
 <script src="../resources/js-test.js"></script>
 </head>
 <body>
-<div>
+
+<div id="content">
     <button id="button-1" aria-labelledby="label1">Button One</button>
     <button id="button-2">Button Two</button>
     <p id="label1">Label for Button One</p>
@@ -23,24 +24,25 @@
     var label2 = accessibilityController.accessibleElementById("label2");
 
     output += expect("button1.description", "'AXDescription: Label for Button One'");
-    output += expect("button1.title", "'AXTitle: '");
+    output += expect("button1.title", "'AXTitle: Label for Button One'");
     output += expect("button2.description", "'AXDescription: '");
 
     setTimeout(async function() {
         document.getElementById("button-2").setAttribute("aria-labelledby", "label2");
         await waitFor(() => button2.description === "AXDescription: Label for Button Two");
         output += expect("button2.description", "'AXDescription: Label for Button Two'");
-        output += expect("button2.title", "'AXTitle: '");
+        output += expect("button2.title", "'AXTitle: Label for Button Two'");
 
         document.getElementById("label1").innerText += "!";
         await waitFor(() => button1.description === "AXDescription: Label for Button One!");
         output += expect("button1.description", "'AXDescription: Label for Button One!'");
-        output += expect("button1.title", "'AXTitle: '");
+        output += expect("button1.title", "'AXTitle: Label for Button One!'");
 
+        document.getElementById("content").style.visibility = "hidden";
         debug(output);
         finishJSTest();
     }, 0);
 }
 </script>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/LayoutTests/accessibility/mac/aria-label-overrides-visible-text-expected.txt b/LayoutTests/accessibility/mac/aria-label-overrides-visible-text-expected.txt
index 2699d0733f13..d7d56fda103d 100644
--- a/LayoutTests/accessibility/mac/aria-label-overrides-visible-text-expected.txt
+++ b/LayoutTests/accessibility/mac/aria-label-overrides-visible-text-expected.txt
@@ -2,7 +2,7 @@ This tests ensures that if aria-label is used, the AXTitle will not expose its c
 PASS: link1.description === 'AXDescription: '
 PASS: link1.title === 'AXTitle: test1'
 PASS: link2.description === 'AXDescription: LINK'
-PASS: link2.title === 'AXTitle: '
+PASS: link2.title === 'AXTitle: LINK'
 
 PASS successfullyParsed is true
 
diff --git a/LayoutTests/accessibility/mac/aria-label-overrides-visible-text.html b/LayoutTests/accessibility/mac/aria-label-overrides-visible-text.html
index ec1cf8b2d544..c4311d0b4ada 100644
--- a/LayoutTests/accessibility/mac/aria-label-overrides-visible-text.html
+++ b/LayoutTests/accessibility/mac/aria-label-overrides-visible-text.html
@@ -21,7 +21,7 @@
 
         var link2 = accessibilityController.accessibleElementById("link2");
         output += expect("link2.description", "'AXDescription: LINK'");
-        output += expect("link2.title", "'AXTitle: '");
+        output += expect("link2.title", "'AXTitle: LINK'");
 
         debug(output);
         document.getElementById("content").style.visibility = "hidden";
diff --git a/LayoutTests/accessibility/radio-button-title-label-expected.txt b/LayoutTests/accessibility/radio-button-title-label-expected.txt
index 8aa9124828e3..cc02f2ded217 100644
--- a/LayoutTests/accessibility/radio-button-title-label-expected.txt
+++ b/LayoutTests/accessibility/radio-button-title-label-expected.txt
@@ -3,10 +3,10 @@ This test checks that radio buttons expose title ui elements correctly under a v
 PASS: radio1.title === 'AXTitle: LABEL'
 PASS: titleUIElement.isEqual(accessibilityController.accessibleElementById('label1')) === true
 PASS: radio2.description === 'AXDescription: LABEL2a'
-PASS: radio2.title === 'AXTitle: '
+PASS: radio2.title === 'AXTitle: LABEL2a'
 PASS: !titleUIElement || titleUIElement.title == 'AXTitle: ' === true
 PASS: radio3.description === 'AXDescription: radio3'
-PASS: radio3.title === 'AXTitle: '
+PASS: radio3.title === 'AXTitle: radio3'
 PASS: !titleUIElement || titleUIElement.title == 'AXTitle: ' === true
 
 PASS successfullyParsed is true
diff --git a/LayoutTests/accessibility/radio-button-title-label.html b/LayoutTests/accessibility/radio-button-title-label.html
index 2f9f5fd16631..ef1699bd7bb7 100644
--- a/LayoutTests/accessibility/radio-button-title-label.html
+++ b/LayoutTests/accessibility/radio-button-title-label.html
@@ -38,7 +38,7 @@
         output += expect("radio2.description", "'AXDescription: '");
     } else {
         output += expect("radio2.description", "'AXDescription: LABEL2a'");
-        output += expect("radio2.title", "'AXTitle: '");
+        output += expect("radio2.title", "'AXTitle: LABEL2a'");
     }
     output += expect("!titleUIElement || titleUIElement.title == 'AXTitle: '", "true");
 
@@ -50,7 +50,7 @@
         output += expect("radio2.description", "'AXDescription: '");
     } else {
         output += expect("radio3.description", "'AXDescription: radio3'");
-        output += expect("radio3.title", "'AXTitle: '");
+        output += expect("radio3.title", "'AXTitle: radio3'");
     }
     output += expect("!titleUIElement || titleUIElement.title == 'AXTitle: '", "true");
 
diff --git a/LayoutTests/accessibility/th-as-title-ui-expected.txt b/LayoutTests/accessibility/th-as-title-ui-expected.txt
deleted file mode 100644
index dee2dae7a175..000000000000
--- a/LayoutTests/accessibility/th-as-title-ui-expected.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Header for button	
-Header for button	
-Pass
diff --git a/LayoutTests/accessibility/th-as-title-ui.html b/LayoutTests/accessibility/th-as-title-ui.html
deleted file mode 100644
index 37c9e40a80e0..000000000000
--- a/LayoutTests/accessibility/th-as-title-ui.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<html>
-<script>
-    if (window.testRunner)
-        testRunner.dumpAsText();
-</script>
-<body id="body">
-    
-    <!-- the AXGroup that comes from the <td> should have the <th> as its title ui element 
-         In the 2nd case, it should not have a title ui element -->
-
-    <table width="90" border="0">
-    <tr>
-    <th>Header for button</th>
-    <td><input type="button" value="button"></td>
-    </tr>
-    </table>
-
-    <table width="90" border="0">
-    <tr>
-    <td>Header for button</td>
-    <td><input type="button" value="button"></td>
-    </tr>
-    </table>
-    
-    <div id="result"></div>
-    
-    <script>
-        if (window.accessibilityController) {
-            var result = document.getElementById("result");
-
-            var body = document.getElementById("body");
-            body.focus();
-            var group = accessibilityController.focusedElement.childAtIndex(1);
-            var group2 = accessibilityController.focusedElement.childAtIndex(3);
-            if (group.titleUIElement().allAttributes() != "" && (group2.titleUIElement() == null || group2.titleUIElement().allAttributes() == "")) 
-                result.innerText += "Pass";
-            else
-                result.innerText += "Fail";
-        }
-    </script>
-</body>
-</html>
diff --git a/LayoutTests/platform/glib/TestExpectations b/LayoutTests/platform/glib/TestExpectations
index 2ad470d0186b..48458714ea5b 100644
--- a/LayoutTests/platform/glib/TestExpectations
+++ b/LayoutTests/platform/glib/TestExpectations
@@ -561,7 +561,6 @@ webkit.org/b/182107 accessibility/aria-combobox-control-owns-elements.html [ Tim
 webkit.org/b/98363 [ Release ] accessibility/canvas-fallback-content-2.html [ Failure ]
 webkit.org/b/98372 accessibility/onclick-handlers.html [ Failure ]
 webkit.org/b/98377 accessibility/textarea-insertion-point-line-number.html [ Timeout ]
-webkit.org/b/98380 accessibility/th-as-title-ui.html [ Failure ]
 webkit.org/b/98382 accessibility/visible-elements.html [ Timeout ]
 
 webkit.org/b/215405 accessibility/roles-computedRoleString.html [ Failure ]
diff --git a/LayoutTests/platform/mac/accessibility/aria-labelledby-overrides-aria-label-expected.txt b/LayoutTests/platform/mac/accessibility/aria-labelledby-overrides-aria-label-expected.txt
index fb6bb6ee92c9..381696d13719 100644
--- a/LayoutTests/platform/mac/accessibility/aria-labelledby-overrides-aria-label-expected.txt
+++ b/LayoutTests/platform/mac/accessibility/aria-labelledby-overrides-aria-label-expected.txt
@@ -3,10 +3,10 @@ This tests that if aria-labelledby is used, then aria-label attributes are not u
 Alpha Beta Delta Eta Epsilon Theta
 usingNone.title: [AXTitle: Alpha]
 usingNone.description: [AXDescription: ]
-usingLabel.title: [AXTitle: ]
+usingLabel.title: [AXTitle: Gamma]
 usingLabel.description: [AXDescription: Gamma]
-usingLabelledby.title: [AXTitle: ]
+usingLabelledby.title: [AXTitle: Epsilon]
 usingLabelledby.description: [AXDescription: Epsilon]
-usingLabeledby.title: [AXTitle: ]
+usingLabeledby.title: [AXTitle: Theta]
 usingLabeledby.description: [AXDescription: Theta]
 
diff --git a/LayoutTests/platform/mac/accessibility/aria-switch-text-expected.txt b/LayoutTests/platform/mac/accessibility/aria-switch-text-expected.txt
index c3a7923e307f..0dcd49126d5c 100644
--- a/LayoutTests/platform/mac/accessibility/aria-switch-text-expected.txt
+++ b/LayoutTests/platform/mac/accessibility/aria-switch-text-expected.txt
@@ -12,7 +12,7 @@ widget.childrenCount is 0
 widget.title is AXTitle: Two
 widget.description is AXDescription:
 widget.childrenCount is 0
-widget.title is AXTitle:
+widget.title is AXTitle: foo
 widget.description is AXDescription: foo
 widget.childrenCount is 0
 PASS successfullyParsed is true
diff --git a/LayoutTests/platform/mac/accessibility/w3c-svg-name-calculation-expected.txt b/LayoutTests/platform/mac/accessibility/w3c-svg-name-calculation-expected.txt
index e6578b8bdf1d..c8195acb3c12 100644
--- a/LayoutTests/platform/mac/accessibility/w3c-svg-name-calculation-expected.txt
+++ b/LayoutTests/platform/mac/accessibility/w3c-svg-name-calculation-expected.txt
@@ -5,25 +5,25 @@ test1:
 	AXTitle:
 	AXDescription: end
 	AXHelp: abc
-	AXTitleUIElement: null
+	AXTitleUIElement: non-null
 test2:
 	Expected name: end
 	AXTitle:
 	AXDescription: end
 	AXHelp:
-	AXTitleUIElement: null
+	AXTitleUIElement: non-null
 test3:
 	Expected name: end
 	AXTitle:
 	AXDescription: end
 	AXHelp: abc
-	AXTitleUIElement: null
+	AXTitleUIElement: non-null
 test4:
 	Expected name: end
 	AXTitle:
 	AXDescription: end
 	AXHelp:
-	AXTitleUIElement: null
+	AXTitleUIElement: non-null
 test5:
 	Expected name: hello
 	AXTitle:
@@ -137,7 +137,7 @@ test23:
 	AXTitle:
 	AXDescription: end
 	AXHelp:
-	AXTitleUIElement: null
+	AXTitleUIElement: non-null
 test24:
 	Expected
 	AXTitle:
@@ -179,7 +179,7 @@ test30:
 	AXTitle:
 	AXDescription: boulder
 	AXHelp:
-	AXTitleUIElement: null
+	AXTitleUIElement: non-null
 test31:
 	Expected name: stone
 	AXTitle:
diff --git a/Source/WebCore/accessibility/AXCoreObject.cpp b/Source/WebCore/accessibility/AXCoreObject.cpp
index a6063dfdf0d3..dadaf1a693f1 100644
--- a/Source/WebCore/accessibility/AXCoreObject.cpp
+++ b/Source/WebCore/accessibility/AXCoreObject.cpp
@@ -538,4 +538,16 @@ String AXCoreObject::helpTextAttributeValue() const
 }
 #endif // PLATFORM(COCOA)
 
+AXCoreObject* AXCoreObject::titleUIElement() const
+{
+    auto labels = relatedObjects(AXRelationType::LabeledBy);
+#if PLATFORM(COCOA)
+    // We impose the restriction that if there is more than one label, then we should return none.
+    // FIXME: the behavior should be the same in all platforms.
+    return labels.size() == 1 ? labels.first().get() : nullptr;
+#else
+    return labels.size() ? labels.first().get() : nullptr;
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/accessibility/AXCoreObject.h b/Source/WebCore/accessibility/AXCoreObject.h
index 9432ded6a85f..2ef103e5c0fd 100644
--- a/Source/WebCore/accessibility/AXCoreObject.h
+++ b/Source/WebCore/accessibility/AXCoreObject.h
@@ -756,7 +756,7 @@ enum class AXRelationType : uint8_t {
     FlowsTo,
     Headers,
     HeaderFor,
-    LabelledBy,
+    LabeledBy,
     LabelFor,
     OwnedBy,
     OwnerFor,
@@ -1020,7 +1020,7 @@ class AXCoreObject : public ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr<AXCo
     AccessibilityChildrenVector errorMessageForObjects() const { return relatedObjects(AXRelationType::ErrorMessageFor); }
     AccessibilityChildrenVector flowToObjects() const { return relatedObjects(AXRelationType::FlowsTo); }
     AccessibilityChildrenVector flowFromObjects() const { return relatedObjects(AXRelationType::FlowsFrom); }
-    AccessibilityChildrenVector labelledByObjects() const { return relatedObjects(AXRelationType::LabelledBy); }
+    AccessibilityChildrenVector labeledByObjects() const { return relatedObjects(AXRelationType::LabeledBy); }
     AccessibilityChildrenVector labelForObjects() const { return relatedObjects(AXRelationType::LabelFor); }
     AccessibilityChildrenVector ownedObjects() const { return relatedObjects(AXRelationType::OwnerFor); }
     AccessibilityChildrenVector owners() const { return relatedObjects(AXRelationType::OwnedBy); }
@@ -1083,9 +1083,7 @@ class AXCoreObject : public ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr<AXCo
     virtual Vector<String> performTextOperation(const AccessibilityTextOperation&) = 0;
 
     virtual AccessibilityChildrenVector linkedObjects() const = 0;
-    virtual AXCoreObject* titleUIElement() const = 0;
-    virtual AXCoreObject* correspondingLabelForControlElement() const = 0;
-    virtual AXCoreObject* correspondingControlForLabelElement() const = 0;
+    virtual AXCoreObject* titleUIElement() const;
     virtual AXCoreObject* scrollBar(AccessibilityOrientation) = 0;
 
     virtual bool inheritsPresentationalRole() const = 0;
diff --git a/Source/WebCore/accessibility/AXLogger.cpp b/Source/WebCore/accessibility/AXLogger.cpp
index 38e4cb2ede66..01b102c97351 100644
--- a/Source/WebCore/accessibility/AXLogger.cpp
+++ b/Source/WebCore/accessibility/AXLogger.cpp
@@ -516,8 +516,8 @@ TextStream& operator<<(TextStream& stream, AXRelationType relationType)
     case AXRelationType::HeaderFor:
         stream << "HeaderFor";
         break;
-    case AXRelationType::LabelledBy:
-        stream << "LabelledBy";
+    case AXRelationType::LabeledBy:
+        stream << "LabeledBy";
         break;
     case AXRelationType::LabelFor:
         stream << "LabelFor";
@@ -620,6 +620,9 @@ TextStream& operator<<(TextStream& stream, AXObjectCache::AXNotification notific
     case AXObjectCache::AXNotification::AXKeyShortcutsChanged:
         stream << "AXKeyShortcutsChanged";
         break;
+    case AXObjectCache::AXNotification::AXLabelChanged:
+        stream << "AXLabelChanged";
+        break;
     case AXObjectCache::AXNotification::AXLanguageChanged:
         stream << "AXLanguageChanged";
         break;
@@ -707,9 +710,6 @@ TextStream& operator<<(TextStream& stream, AXObjectCache::AXNotification notific
     case AXObjectCache::AXNotification::AXScrolledToAnchor:
         stream << "AXScrolledToAnchor";
         break;
-    case AXObjectCache::AXNotification::AXLabelCreated:
-        stream << "AXLabelCreated";
-        break;
     case AXObjectCache::AXNotification::AXLiveRegionCreated:
         stream << "AXLiveRegionCreated";
         break;
diff --git a/Source/WebCore/accessibility/AXObjectCache.cpp b/Source/WebCore/accessibility/AXObjectCache.cpp
index 024ea342700c..6c7162e4fc95 100644
--- a/Source/WebCore/accessibility/AXObjectCache.cpp
+++ b/Source/WebCore/accessibility/AXObjectCache.cpp
@@ -735,8 +735,9 @@ Ref<AccessibilityObject> AXObjectCache::createObjectFromRenderer(RenderObject* r
     if ((is<RenderTableCell>(renderer) && !renderer->isAnonymous()) || isAccessibilityTableCell(node))
         return AccessibilityTableCell::create(renderer);
 
-    // progress bar
-    if (is<RenderProgress>(renderer) || is<HTMLProgressElement>(node))
+    // Progress indicator.
+    if (is<RenderProgress>(renderer) || is<RenderMeter>(renderer)
+        || is<HTMLProgressElement>(node) || is<HTMLMeterElement>(node))
         return AccessibilityProgressIndicator::create(renderer);
 
 #if ENABLE(ATTACHMENT_ELEMENT)
@@ -744,9 +745,6 @@ Ref<AccessibilityObject> AXObjectCache::createObjectFromRenderer(RenderObject* r
         return AccessibilityAttachment::create(downcast<RenderAttachment>(renderer));
 #endif
 
-    if (is<RenderMeter>(renderer) || is<HTMLMeterElement>(node))
-        return AccessibilityProgressIndicator::create(renderer);
-
     // input type=range
     if (is<RenderSlider>(renderer))
         return AccessibilitySlider::create(renderer);
@@ -1054,13 +1052,15 @@ void AXObjectCache::remove(AXID axID)
     AXTRACE(makeString("AXObjectCache::remove 0x"_s, hex(reinterpret_cast<uintptr_t>(this))));
     AXLOG(makeString("AXID ", axID.loggingString()));
 
-    if (!axID)
+    if (!axID.isValid())
         return;
 
     auto object = m_objects.take(axID);
     if (!object)
         return;
 
+    removeRelations(axID);
+
 #if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
     if (auto tree = AXIsolatedTree::treeForPageID(m_pageID))
         tree->removeNode(*object);
@@ -1074,9 +1074,11 @@ void AXObjectCache::remove(AXID axID)
 #endif
     ASSERT(m_objects.size() >= m_idsInUse.size());
 }
-    
+
 void AXObjectCache::remove(RenderObject* renderer)
 {
+    AXTRACE(makeString("AXObjectCache::remove RenderObject* 0x"_s, hex(reinterpret_cast<uintptr_t>(this))));
+
     if (!renderer)
         return;
     remove(m_renderObjectMapping.take(renderer));
@@ -1084,7 +1086,7 @@ void AXObjectCache::remove(RenderObject* renderer)
 
 void AXObjectCache::remove(Node& node)
 {
-    AXTRACE(makeString("AXObjectCache::remove 0x"_s, hex(reinterpret_cast<uintptr_t>(this))));
+    AXTRACE(makeString("AXObjectCache::remove Node& 0x"_s, hex(reinterpret_cast<uintptr_t>(this))));
 
     removeNodeForUse(node);
     remove(m_nodeObjectMapping.take(&node));
@@ -1161,12 +1163,12 @@ void AXObjectCache::handleTextChanged(AccessibilityObject* object)
     // If this element supports ARIA live regions, or is part of a region with an ARIA editable role,
     // then notify the AT of changes.
     bool notifiedNonNativeTextControl = false;
-    for (auto* parent = object; parent; parent = parent->parentObject()) {
+    for (RefPtr parent = object; parent; parent = parent->parentObject()) {
         if (parent->supportsLiveRegion())
-            postLiveRegionChangeNotification(parent);
+            postLiveRegionChangeNotification(parent.get());
 
         if (!notifiedNonNativeTextControl && parent->isNonNativeTextControl()) {
-            postNotification(parent, parent->document(), AXValueChanged);
+            postNotification(parent.get(), parent->document(), AXValueChanged);
             notifiedNonNativeTextControl = true;
         }
     }
@@ -1248,6 +1250,9 @@ void AXObjectCache::handleAllDeferredChildrenChanged()
 
 void AXObjectCache::handleChildrenChanged(AccessibilityObject& object)
 {
+    AXTRACE("AXObjectCache::handleChildrenChanged"_s);
+    AXLOG(object);
+
     // Handle MenuLists and MenuListPopups as special cases.
     if (is<AccessibilityMenuList>(object)) {
         auto& children = object.children(false);
@@ -1276,7 +1281,7 @@ void AXObjectCache::handleChildrenChanged(AccessibilityObject& object)
 
     // Go up the existing ancestors chain and fire the appropriate notifications.
     bool shouldUpdateParent = true;
-    for (auto* parent = &object; parent; parent = parent->parentObjectIfExists()) {
+    for (RefPtr parent = &object; parent; parent = parent->parentObjectIfExists()) {
         if (shouldUpdateParent)
             parent->setNeedsToUpdateChildren();
 
@@ -1285,19 +1290,19 @@ void AXObjectCache::handleChildrenChanged(AccessibilityObject& object)
         // Sometimes this function can be called many times within a short period of time, leading to posting too many AXLiveRegionChanged notifications.
         // To fix this, we use a timer to make sure we only post one notification for the children changes within a pre-defined time interval.
         if (parent->supportsLiveRegion())
-            postLiveRegionChangeNotification(parent);
+            postLiveRegionChangeNotification(parent.get());
 
         // If this object is an ARIA text control, notify that its value changed.
         if (parent->isNonNativeTextControl()) {
-            postNotification(parent, parent->document(), AXValueChanged);
+            postNotification(parent.get(), parent->document(), AXValueChanged);
 
             // Do not let any ancestor of an editable object update its children.
             shouldUpdateParent = false;
         }
 
-        if (auto objects = parent->labelForObjects(); objects.size()) {
-            for (const auto& axObject : objects)
-                postNotification(dynamicDowncast<AccessibilityObject>(axObject.get()), axObject->document(), AXValueChanged);
+        if (parent->isLabel()) {
+            // A label's descendant was added or removed. Update its LabelFor relationships.
+            handleLabelChanged(parent.get());
         }
     }
 
@@ -1346,15 +1351,6 @@ void AXObjectCache::handleLiveRegionCreated(Node* node)
         postNotification(getOrCreate(node), &document(), AXLiveRegionCreated);
 }
 
-void AXObjectCache::handleLabelCreated(HTMLLabelElement* element)
-{
-#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
-    postNotification(getOrCreate(element), nullptr, AXLabelCreated);
-#else
-    UNUSED_PARAM(element);
-#endif
-}
-
 void AXObjectCache::deferNodeAddedOrRemoved(Node* node)
 {
     if (!node)
@@ -2445,9 +2441,10 @@ void AXObjectCache::handleAttributeChange(Element* element, const QualifiedName&
     }
     else if (attrName == disabledAttr)
         postNotification(element, AXDisabledStateChanged);
-    else if (attrName == forAttr && is<HTMLLabelElement>(element))
-        handleLabelForChanged(downcast<HTMLLabelElement>(*element), oldValue);
-    else if (attrName == requiredAttr)
+    else if (attrName == forAttr) {
+        if (RefPtr label = dynamicDowncast<HTMLLabelElement>(element))
+            updateLabelFor(*label);
+    } else if (attrName == requiredAttr)
         postNotification(element, AXRequiredStatusChanged);
     else if (attrName == tabindexAttr) {
         if (oldValue.isEmpty() || newValue.isEmpty()) {
@@ -2619,12 +2616,49 @@ void AXObjectCache::handleAttributeChange(Element* element, const QualifiedName&
     }
 }
 
-void AXObjectCache::handleLabelForChanged(HTMLLabelElement& label, const AtomString& oldValue)
+void AXObjectCache::handleLabelChanged(AccessibilityObject* object)
 {
-    RefPtr currentControl = label.control();
-    deferTextChangedIfNeeded(currentControl.get());
-    RefPtr oldControl = label.treeScope().getElementById(oldValue);
-    deferTextChangedIfNeeded(oldControl.get());
+    AXTRACE("AXObjectCache::handleLabelChanged"_s);
+
+    if (!object)
+        return;
+
+    if (RefPtr label = dynamicDowncast<HTMLLabelElement>(object->element()))
+        updateLabelFor(*label);
+    else {
+        auto labeledObjects = object->labelForObjects();
+        for (auto& labeledObject : labeledObjects) {
+            updateLabeledBy(RefPtr { labeledObject->element() }.get());
+            postNotification(downcast<AccessibilityObject>(labeledObject.get()), &document(), AXValueChanged);
+        }
+    }
+
+    postNotification(object, &document(), AXLabelChanged);
+}
+
+void AXObjectCache::updateLabelFor(HTMLLabelElement& label)
+{
+    removeRelations(label, AXRelationType::LabelFor);
+    addLabelForRelation(label);
+}
+
+void AXObjectCache::updateLabeledBy(Element* element)
+{
+    if (!element)
+        return;
+
+    removeRelations(*element, AXRelationType::LabeledBy);
+    addRelations(*element, aria_labelledbyAttr);
+    dirtyIsolatedTreeRelations();
+}
+
+void AXObjectCache::dirtyIsolatedTreeRelations()
+{
+#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
+    if (auto tree = AXIsolatedTree::treeForPageID(m_pageID))
+        tree->relationsNeedUpdate(true);
+    startUpdateTreeSnapshotTimer();
+#endif
 }
 
 void AXObjectCache::recomputeIsIgnored(RenderObject* renderer)
@@ -3953,7 +3987,11 @@ void AXObjectCache::performDeferredCacheUpdate()
         if (RefPtr node = weakNode.get()) {
             handleMenuOpened(node.get());
             handleLiveRegionCreated(node.get());
-            handleLabelCreated(dynamicDowncast<HTMLLabelElement>(node.get()));
+
+            if (RefPtr label = dynamicDowncast<HTMLLabelElement>(node.get())) {
+                // A label was added or removed. Update its LabelFor relationships.
+                handleLabelChanged(getOrCreate(label.get()));
+            }
         }
     }
     m_deferredNodeAddedOrRemovedList.clear();
@@ -4069,7 +4107,7 @@ void AXObjectCache::performDeferredCacheUpdate()
         handleScrollbarUpdate(scrollView);
     });
     m_deferredScrollbarUpdateChangeList.clear();
-    
+
 #if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
     if (m_deferredRegenerateIsolatedTree) {
         if (auto tree = AXIsolatedTree::treeForPageID(m_pageID)) {
@@ -4134,6 +4172,7 @@ void AXObjectCache::updateIsolatedTree(const Vector<std::pair<RefPtr<Accessibili
     struct UpdatedFields {
         bool children { false };
         bool node { false };
+        bool dependentProperties { false };
     };
     HashMap<AXID, UpdatedFields> updatedObjects;
     auto updateNode = [&] (RefPtr<AccessibilityObject> axObject) {
@@ -4190,9 +4229,6 @@ void AXObjectCache::updateIsolatedTree(const Vector<std::pair<RefPtr<Accessibili
         case AXFocusableStateChanged:
             tree->queueNodeUpdate(*notification.first, { AXPropertyName::CanSetFocusAttribute });
             break;
-        case AXLabelCreated:
-            tree->labelCreated(*notification.first);
-            break;
         case AXMaximumValueChanged:
             tree->queueNodeUpdate(*notification.first, { { AXPropertyName::MaxValueForRange, AXPropertyName::ValueForRange } });
             break;
@@ -4291,17 +4327,21 @@ void AXObjectCache::updateIsolatedTree(const Vector<std::pair<RefPtr<Accessibili
         case AXMultiSelectableStateChanged:
         case AXPressedStateChanged:
         case AXSelectedChildrenChanged:
+        case AXTextChanged:
         case AXTextSecurityChanged:
         case AXValueChanged:
             updateNode(notification.first);
             break;
-        case AXTextChanged:
+        case AXLabelChanged: {
             updateNode(notification.first);
-            if (RefPtr axParent = notification.first->parentObject(); axParent && axParent->isLabel()) {
-                if (RefPtr correspondingControl = axParent->correspondingControlForLabelElement())
-                    updateNode(correspondingControl.get());
+
+            auto updatedFields = updatedObjects.get(notification.first->objectID());
+            if (!updatedFields.dependentProperties) {
+                updatedObjects.set(notification.first->objectID(), UpdatedFields { updatedFields.children, updatedFields.node, true });
+                tree->updateDependentProperties(*notification.first);
             }
             break;
+        }
         case AXLanguageChanged:
         case AXRowCountChanged:
             updateNode(notification.first);
@@ -4566,10 +4606,10 @@ AXRelationType AXObjectCache::symmetricRelation(AXRelationType relationType)
         return AXRelationType::HeaderFor;
     case AXRelationType::HeaderFor:
         return AXRelationType::Headers;
-    case AXRelationType::LabelledBy:
+    case AXRelationType::LabeledBy:
         return AXRelationType::LabelFor;
     case AXRelationType::LabelFor:
-        return AXRelationType::LabelledBy;
+        return AXRelationType::LabeledBy;
     case AXRelationType::OwnedBy:
         return AXRelationType::OwnerFor;
     case AXRelationType::OwnerFor:
@@ -4595,7 +4635,7 @@ AXRelationType AXObjectCache::attributeToRelationType(const QualifiedName& attri
     if (attribute == aria_flowtoAttr)
         return AXRelationType::FlowsTo;
     if (attribute == aria_labelledbyAttr || attribute == aria_labeledbyAttr)
-        return AXRelationType::LabelledBy;
+        return AXRelationType::LabeledBy;
     if (attribute == aria_ownsAttr)
         return AXRelationType::OwnerFor;
     if (attribute == headersAttr)
@@ -4607,19 +4647,27 @@ static bool validRelation(void* origin, void* target, AXRelationType relationTyp
 {
     if (!origin || !target || relationType == AXRelationType::None)
         return false;
-    
-    if (origin == target && relationType != AXRelationType::LabelledBy)
-        return false;
-    
-    return true;
+    return origin != target || relationType == AXRelationType::LabeledBy;
 }
 
 void AXObjectCache::addRelation(Element* origin, Element* target, AXRelationType relationType)
 {
+    AXTRACE("AXObjectCache::addRelation"_s);
+    AXLOG(makeString("origin: ", origin->debugDescription(), " target: ", target->debugDescription(), " relationType ", String::number(static_cast<uint>(relationType))));
+
     if (!validRelation(origin, target, relationType)) {
         ASSERT_NOT_REACHED();
         return;
     }
+
+    if (relationType == AXRelationType::LabelFor) {
+        // Add a LabelFor relation if the target doesn't have an ARIA label which should take precedence.
+        if (target->hasAttributeWithoutSynchronization(aria_labelAttr)
+            || target->hasAttributeWithoutSynchronization(aria_labelledbyAttr)
+            || target->hasAttributeWithoutSynchronization(aria_labeledbyAttr))
+            return;
+    }
+
     addRelation(getOrCreate(origin, IsPartOfRelation::Yes), getOrCreate(target, IsPartOfRelation::Yes), relationType);
 }
 
@@ -4713,6 +4761,26 @@ void AXObjectCache::addRelation(AccessibilityObject* origin, AccessibilityObject
     }
 }
 
+void AXObjectCache::removeRelations(AXID axID)
+{
+    auto it = m_relations.find(axID);
+    if (it == m_relations.end())
+        return;
+
+    for (auto relationType : it->value.keys()) {
+        auto symmetric = symmetricRelation(static_cast<AXRelationType>(relationType));
+        if (symmetric == AXRelationType::None)
+            continue;
+
+        auto targetIDs = it->value.get(static_cast<uint8_t>(relationType));
+        for (AXID targetID : targetIDs)
+            removeRelationByID(targetID, axID, symmetric);
+    }
+
+    m_relations.remove(it);
+    dirtyIsolatedTreeRelations();
+}
+
 void AXObjectCache::removeRelations(Element& origin, AXRelationType relationType)
 {
     AXTRACE("AXObjectCache::removeRelations"_s);
@@ -4739,6 +4807,10 @@ void AXObjectCache::removeRelations(Element& origin, AXRelationType relationType
 
 void AXObjectCache::removeRelationByID(AXID originID, AXID targetID, AXRelationType relationType)
 {
+    AXTRACE("AXObjectCache::removeRelationByID"_s);
+    AXLOG(makeString("originID ", originID.loggingString(), " targetID ", targetID.loggingString()));
+    AXLOG(relationType);
+
     auto relationsIterator = m_relations.find(originID);
     if (relationsIterator == m_relations.end())
         return;
@@ -4775,21 +4847,31 @@ void AXObjectCache::updateRelationsForTree(ContainerNode& rootNode)
 
         for (const auto& attribute : relationAttributes())
             addRelations(element, attribute);
+
+        // In addition to ARIA specified relations, there may be other relevant relations.
+        // For instance, LabelFor in HTMLLabelElements.
+        addLabelForRelation(element);
     }
 }
 
 void AXObjectCache::addRelations(Element& origin, const QualifiedName& attribute)
 {
+    if (attribute == aria_labeledbyAttr && origin.hasAttribute(aria_labelledbyAttr)) {
+        // The attribute name with British spelling should override the one with American spelling.
+        return;
+    }
+
+    auto relationType = attributeToRelationType(attribute);
     if (m_document->settings().ariaReflectionForElementReferencesEnabled()) {
         if (Element::isElementReflectionAttribute(m_document->settings(), attribute)) {
             if (auto reflectedElement = origin.getElementAttribute(attribute)) {
-                addRelation(&origin, reflectedElement.get(), attributeToRelationType(attribute));
+                addRelation(&origin, reflectedElement.get(), relationType);
                 return;
             }
         } else if (Element::isElementsArrayReflectionAttribute(m_document->settings(), attribute)) {
             if (auto reflectedElements = origin.getElementsArrayAttribute(attribute)) {
                 for (auto reflectedElement : reflectedElements.value())
-                    addRelation(&origin, reflectedElement.get(), attributeToRelationType(attribute));
+                    addRelation(&origin, reflectedElement.get(), relationType);
                 return;
             }
         }
@@ -4799,7 +4881,7 @@ void AXObjectCache::addRelations(Element& origin, const QualifiedName& attribute
     if (value.isNull()) {
         if (auto* defaultARIA = origin.customElementDefaultARIAIfExists()) {
             for (auto& target : defaultARIA->elementsForAttribute(origin, attribute))
-                addRelation(&origin, target.get(), attributeToRelationType(attribute));
+                addRelation(&origin, target.get(), relationType);
         }
         return;
     }
@@ -4810,7 +4892,24 @@ void AXObjectCache::addRelations(Element& origin, const QualifiedName& attribute
         if (!target || target == &origin)
             continue;
 
-        addRelation(&origin, target.get(), attributeToRelationType(attribute));
+        addRelation(&origin, target.get(), relationType);
+    }
+}
+
+void AXObjectCache::addLabelForRelation(Element& origin)
+{
+    // LabelFor relations are established for <label for=...> and for <figcaption> elements.
+    if (RefPtr label = dynamicDowncast<HTMLLabelElement>(origin)) {
+        if (auto control = Accessibility::controlForLabelElement(*label)) {
+            addRelation(&origin, control.get(), AXRelationType::LabelFor);
+            dirtyIsolatedTreeRelations();
+        }
+    } else if (origin.hasTagName(figcaptionTag)) {
+        RefPtr parent = origin.parentNode();
+        if (parent && parent->hasTagName(figureTag)) {
+            addRelation(getOrCreate(&origin), getOrCreate(parent.get()), AXRelationType::LabelFor);
+            dirtyIsolatedTreeRelations();
+        }
     }
 }
 
@@ -4831,24 +4930,14 @@ void AXObjectCache::updateRelations(Element& origin, const QualifiedName& attrib
 
     removeRelations(origin, relationType);
     addRelations(origin, attribute);
-
-#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
-    if (auto tree = AXIsolatedTree::treeForPageID(m_pageID))
-        tree->relationsNeedUpdate(true);
-#endif
+    dirtyIsolatedTreeRelations();
 }
 
 void AXObjectCache::relationsNeedUpdate(bool needUpdate)
 {
     m_relationsNeedUpdate = needUpdate;
-
-#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
-    if (m_relationsNeedUpdate) {
-        if (auto tree = AXIsolatedTree::treeForPageID(m_pageID))
-            tree->relationsNeedUpdate(true);
-        startUpdateTreeSnapshotTimer();
-    }
-#endif
+    if (m_relationsNeedUpdate)
+        dirtyIsolatedTreeRelations();
 }
 
 HashMap<AXID, AXRelations> AXObjectCache::relations()
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index 5f34e9c59d01..a09eb5119463 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -364,6 +364,7 @@ class AXObjectCache : public CanMakeWeakPtr<AXObjectCache>, public CanMakeChecke
         AXImageOverlayChanged,
         AXIsAtomicChanged,
         AXKeyShortcutsChanged,
+        AXLabelChanged,
         AXLanguageChanged,
         AXLayoutComplete,
         AXLevelChanged,
@@ -391,7 +392,6 @@ class AXObjectCache : public CanMakeWeakPtr<AXObjectCache>, public CanMakeChecke
         AXValueChanged,
         AXVisibilityChanged,
         AXScrolledToAnchor,
-        AXLabelCreated,
         AXLiveRegionCreated,
         AXLiveRegionChanged,
         AXLiveRegionRelevantChanged,
@@ -536,7 +536,7 @@ class AXObjectCache : public CanMakeWeakPtr<AXObjectCache>, public CanMakeChecke
 #endif
 
     void frameLoadingEventPlatformNotification(AccessibilityObject*, AXLoadingEvent);
-    void handleLabelForChanged(HTMLLabelElement&, const AtomString& /* oldValue */);
+    void handleLabelChanged(AccessibilityObject*);
 
     // This is a weak reference cache for knowing if Nodes used by TextMarkers are valid.
     void setNodeInUse(Node* n) { m_textMarkerNodes.add(n); }
@@ -605,7 +605,6 @@ class AXObjectCache : public CanMakeWeakPtr<AXObjectCache>, public CanMakeChecke
     void handleRoleDescriptionChanged(Element*);
     void handleMenuOpened(Node*);
     void handleLiveRegionCreated(Node*);
-    void handleLabelCreated(HTMLLabelElement*);
     void handleMenuItemSelected(Node*);
     void handleTabPanelSelected(Node*, Node*);
     void handleRowCountChanged(AccessibilityObject*, Document*);
@@ -642,10 +641,15 @@ class AXObjectCache : public CanMakeWeakPtr<AXObjectCache>, public CanMakeChecke
     void addRelation(AccessibilityObject*, AccessibilityObject*, AXRelationType, AddSymmetricRelation = AddSymmetricRelation::Yes);
     void removeRelationByID(AXID originID, AXID targetID, AXRelationType);
     void addRelations(Element&, const QualifiedName&);
+    void addLabelForRelation(Element&);
     void removeRelations(Element&, AXRelationType);
+    void removeRelations(AXID);
+    void updateLabelFor(HTMLLabelElement&);
+    void updateLabeledBy(Element*);
     void updateRelationsIfNeeded();
     void updateRelationsForTree(ContainerNode&);
     void relationsNeedUpdate(bool);
+    void dirtyIsolatedTreeRelations();
     HashMap<AXID, AXRelations> relations();
     const HashSet<AXID>& relationTargetIDs();
     bool isDescendantOfRelatedNode(Node&);
diff --git a/Source/WebCore/accessibility/AccessibilityLabel.cpp b/Source/WebCore/accessibility/AccessibilityLabel.cpp
index 6225fe044455..9a5948fa521c 100644
--- a/Source/WebCore/accessibility/AccessibilityLabel.cpp
+++ b/Source/WebCore/accessibility/AccessibilityLabel.cpp
@@ -83,33 +83,6 @@ bool AccessibilityLabel::containsOnlyStaticText() const
     return m_containsOnlyStaticText;
 }
 
-static bool childrenContainUnrelatedControls(const AccessibilityObject::AccessibilityChildrenVector& children, AccessibilityObject* controlForLabel)
-{
-    if (!children.size())
-        return false;
-
-    for (const auto& child : children) {
-        if (child->isControl()) {
-            if (child == controlForLabel)
-                continue;
-            return true;
-        }
-
-        if (childrenContainUnrelatedControls(child->children(), controlForLabel))
-            return true;
-    }
-
-    return false;
-}
-
-bool AccessibilityLabel::containsUnrelatedControls() const
-{
-    if (containsOnlyStaticText())
-        return false;
-
-    return childrenContainUnrelatedControls(m_children, correspondingControlForLabelElement());
-}
-
 void AccessibilityLabel::updateChildrenIfNecessary()
 {
     AccessibilityRenderObject::updateChildrenIfNecessary();
diff --git a/Source/WebCore/accessibility/AccessibilityLabel.h b/Source/WebCore/accessibility/AccessibilityLabel.h
index 551063ab806e..348492f3318a 100644
--- a/Source/WebCore/accessibility/AccessibilityLabel.h
+++ b/Source/WebCore/accessibility/AccessibilityLabel.h
@@ -36,17 +36,15 @@ class AccessibilityLabel final : public AccessibilityRenderObject {
 public:
     static Ref<AccessibilityLabel> create(RenderObject*);
     virtual ~AccessibilityLabel();
-    
-    bool containsOnlyStaticText() const;
-    bool containsUnrelatedControls() const;
 
+    bool containsOnlyStaticText() const;
 private:
     explicit AccessibilityLabel(RenderObject*);
     bool computeAccessibilityIsIgnored() const final;
 
     AccessibilityRole determineAccessibilityRole() final { return AccessibilityRole::Label; }
 
-    bool isLabel() const final { return true; }
+    bool isAccessibilityLabelInstance() const final { return true; }
     String stringValue() const final;
     void updateChildrenIfNecessary() final;
     void clearChildren() final;
@@ -58,5 +56,5 @@ class AccessibilityLabel final : public AccessibilityRenderObject {
 } // namespace WebCore
 
 SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::AccessibilityLabel) \
-    static bool isType(const WebCore::AccessibilityObject& object) { return object.isLabel(); } \
+    static bool isType(const WebCore::AccessibilityObject& object) { return object.isAccessibilityLabelInstance(); } \
 SPECIALIZE_TYPE_TRAITS_END()
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
index 9a7074d68a37..3eb714fa610d 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
@@ -146,7 +146,7 @@ AccessibilityObject* AccessibilityNodeObject::lastChild() const
 {
     if (!node())
         return nullptr;
-    
+
     Node* lastChild = node()->lastChild();
     if (!lastChild)
         return nullptr;
@@ -180,12 +180,12 @@ AccessibilityObject* AccessibilityNodeObject::nextSibling() const
     auto objectCache = axObjectCache();
     return objectCache ? objectCache->getOrCreate(nextSibling) : nullptr;
 }
-    
+
 AccessibilityObject* AccessibilityNodeObject::parentObjectIfExists() const
 {
     return parentObject();
 }
-    
+
 AccessibilityObject* AccessibilityNodeObject::ownerParentObject() const
 {
     auto owners = this->owners();
@@ -200,56 +200,20 @@ AccessibilityObject* AccessibilityNodeObject::parentObject() const
 
     if (auto* ownerParent = ownerParentObject())
         return ownerParent;
-    
+
     Node* parentObj = node()->parentNode();
     if (!parentObj)
         return nullptr;
-    
+
     if (AXObjectCache* cache = axObjectCache())
         return cache->getOrCreate(parentObj);
-    
-    return nullptr;
-}
 
-static Vector<Ref<HTMLLabelElement>> labelsForNode(Node* node)
-{
-    auto* element = dynamicDowncast<HTMLElement>(node);
-    if (!element || !element->isLabelable())
-        return { };
-
-    const auto& id = element->getIdAttribute();
-    if (!id.isEmpty()) {
-        if (auto* treeScopeLabels = element->treeScope().labelElementsForId(id); treeScopeLabels && !treeScopeLabels->isEmpty()) {
-            return WTF::compactMap(*treeScopeLabels, [](auto& label) {
-                return RefPtr<HTMLLabelElement> { dynamicDowncast<HTMLLabelElement>(label.get()) };
-            });
-        }
-    }
-
-    if (RefPtr nearestLabel = ancestorsOfType<HTMLLabelElement>(*element).first()) {
-        // Only use the nearest label if it isn't pointing at something else.
-        const auto& forAttribute = nearestLabel->attributeWithoutSynchronization(forAttr);
-        if (forAttribute.isEmpty() || forAttribute == id)
-            return { nearestLabel.releaseNonNull() };
-    }
-    return { };
-}
-
-static RefPtr<HTMLLabelElement> labelForNode(Node* node)
-{
-    auto labels = labelsForNode(node);
-#if PLATFORM(COCOA)
-    // We impose the restriction that if there is more than one label element for the given Node, then we should return none.
-    // FIXME: the behavior should be the same in all platforms.
-    return labels.size() == 1 ? RefPtr { WTFMove(labels.first()) } : nullptr;
-#else
-    return labels.size() >= 1 ? RefPtr { WTFMove(labels.first()) } : nullptr;
-#endif
+    return nullptr;
 }
 
 LayoutRect AccessibilityNodeObject::checkboxOrRadioRect() const
 {
-    auto labels = labelsForNode(node());
+    auto labels = Accessibility::labelsForElement(element());
     if (labels.isEmpty())
         return boundingBoxRect();
 
@@ -573,7 +537,7 @@ void AccessibilityNodeObject::updateOwnedChildren()
 
 void AccessibilityNodeObject::addChildren()
 {
-    // If the need to add more children in addition to existing children arises, 
+    // If the need to add more children in addition to existing children arises,
     // childrenChanged should have been called, leaving the object with no children.
     ASSERT(!m_childrenInitialized);
     m_childrenInitialized = true;
@@ -755,7 +719,6 @@ bool AccessibilityNodeObject::isSecureField() const
     RefPtr input = dynamicDowncast<HTMLInputElement>(node());
     if (!input || ariaRoleAttribute() != AccessibilityRole::Unknown)
         return false;
-
     return input->isSecureField();
 }
 
@@ -777,10 +740,10 @@ bool AccessibilityNodeObject::isEnabled() const
         if (equalLettersIgnoringASCIICase(disabledStatus, "false"_s))
             break;
     }
-    
+
     if (roleValue() == AccessibilityRole::HorizontalRule)
         return false;
-    
+
     RefPtr element = dynamicDowncast<Element>(node());
     return !element || !element->isDisabledFormControl();
 }
@@ -839,7 +802,7 @@ bool AccessibilityNodeObject::isChecked() const
     default:
         break;
     }
-    
+
     if (validRole && equalLettersIgnoringASCIICase(getAttribute(aria_checkedAttr), "true"_s))
         return true;
 
@@ -1235,16 +1198,16 @@ static bool isNodeActionElement(Node* node)
 
     return false;
 }
-    
+
 static Element* nativeActionElement(Node* start)
 {
     if (!start)
         return nullptr;
-    
+
     // Do a deep-dive to see if any nodes should be used as the action element.
     // We have to look at Nodes, since this method should only be called on objects that do not have children (like buttons).
     // It solves the problem when authors put role="button" on a group and leave the actual button inside the group.
-    
+
     for (Node* child = start->firstChild(); child; child = child->nextSibling()) {
         if (isNodeActionElement(child))
             return downcast<Element>(child);
@@ -1254,7 +1217,7 @@ static Element* nativeActionElement(Node* start)
     }
     return nullptr;
 }
-    
+
 Element* AccessibilityNodeObject::actionElement() const
 {
     Node* node = this->node();
@@ -1263,7 +1226,7 @@ Element* AccessibilityNodeObject::actionElement() const
 
     if (isNodeActionElement(node))
         return downcast<Element>(node);
-    
+
     if (AccessibilityObject::isARIAInput(ariaRoleAttribute()))
         return downcast<Element>(node);
 
@@ -1283,7 +1246,7 @@ Element* AccessibilityNodeObject::actionElement() const
     default:
         break;
     }
-    
+
     Element* elt = anchorElement();
     if (!elt)
         elt = mouseButtonListener();
@@ -1303,7 +1266,7 @@ Element* AccessibilityNodeObject::mouseButtonListener(MouseButtonListenerResultF
         // It can cause false positives, where every piece of text is labeled as accepting press actions.
         if (element.hasTagName(bodyTag) && isStaticText() && filter == ExcludeBodyElement)
             break;
-        
+
         if (element.hasEventListeners(eventNames().clickEvent) || element.hasEventListeners(eventNames().mousedownEvent) || element.hasEventListeners(eventNames().mouseupEvent))
             return &element;
     }
@@ -1315,7 +1278,7 @@ bool AccessibilityNodeObject::isDescendantOfBarrenParent() const
 {
     if (!m_isIgnoredFromParentData.isNull())
         return m_isIgnoredFromParentData.isDescendantOfBarrenParent;
-    
+
     for (AccessibilityObject* object = parentObject(); object; object = object->parentObject()) {
         if (!object->canHaveChildren())
             return true;
@@ -1328,7 +1291,7 @@ void AccessibilityNodeObject::alterRangeValue(StepAction stepAction)
 {
     if (roleValue() != AccessibilityRole::Slider && roleValue() != AccessibilityRole::SpinButton)
         return;
-    
+
     auto element = this->element();
     if (!element || element->isDisabledFormControl())
         return;
@@ -1338,7 +1301,7 @@ void AccessibilityNodeObject::alterRangeValue(StepAction stepAction)
     else
         changeValueByPercent(stepAction == StepAction::Increment ? 5 : -5);
 }
-    
+
 void AccessibilityNodeObject::increment()
 {
     UserGestureIndicator gestureIndicator(IsProcessingUserGesture::Yes, document());
@@ -1355,14 +1318,14 @@ static bool dispatchSimulatedKeyboardUpDownEvent(AccessibilityObject* object, co
 {
     // In case the keyboard event causes this element to be removed.
     Ref<AccessibilityObject> protectedObject(*object);
-    
+
     bool handled = false;
     if (auto* node = object->node()) {
         auto event = KeyboardEvent::create(eventNames().keydownEvent, keyInit, Event::IsTrusted::Yes);
         node->dispatchEvent(event);
         handled |= event->defaultHandled();
     }
-    
+
     // Ensure node is still valid and wasn't removed after the keydown.
     if (auto* node = object->node()) {
         auto event = KeyboardEvent::create(eventNames().keyupEvent, keyInit, Event::IsTrusted::Yes);
@@ -1419,7 +1382,7 @@ bool AccessibilityNodeObject::postKeyboardKeysForValueChange(StepAction stepActi
 void AccessibilityNodeObject::setNodeValue(StepAction stepAction, float value)
 {
     bool didSet = setValue(String::number(value));
-    
+
     if (didSet) {
         if (auto* cache = axObjectCache())
             cache->postNotification(this, document(), AXObjectCache::AXValueChanged);
@@ -1593,7 +1556,7 @@ bool AccessibilityNodeObject::isGenericFocusableElement() const
     // If it's a control, it's not generic.
     if (isControl())
         return false;
-    
+
     AccessibilityRole role = roleValue();
     if (role == AccessibilityRole::Video || role == AccessibilityRole::Audio)
         return false;
@@ -1624,31 +1587,10 @@ bool AccessibilityNodeObject::isGenericFocusableElement() const
     return true;
 }
 
-AccessibilityObject* AccessibilityNodeObject::correspondingControlForLabelElement() const
+AccessibilityObject* AccessibilityNodeObject::controlForLabelElement() const
 {
     auto* labelElement = labelElementContainer();
-    if (!labelElement)
-        return nullptr;
-
-    auto correspondingControl = labelElement->control();
-    if (!correspondingControl)
-        return nullptr;
-
-    // Make sure the corresponding control isn't a descendant of this label that's in the middle of being destroyed.
-    if (correspondingControl->renderer() && !correspondingControl->renderer()->parent())
-        return nullptr;
-
-    return axObjectCache()->getOrCreate(correspondingControl.get());
-}
-
-AccessibilityObject* AccessibilityNodeObject::correspondingLabelForControlElement() const
-{
-    // ARIA: section 2A, bullet #3 says if aria-labeledby or aria-label appears, it should
-    // override the "label" element association.
-    if (hasTextAlternative())
-        return nullptr;
-
-    return axObjectCache()->getOrCreate(labelForNode(node()).get());
+    return labelElement ? axObjectCache()->getOrCreate(Accessibility::controlForLabelElement(*labelElement).get()) : nullptr;
 }
 
 String AccessibilityNodeObject::ariaAccessibilityDescription() const
@@ -1699,7 +1641,7 @@ Element* AccessibilityNodeObject::menuItemElementForMenu() const
 {
     if (ariaRoleAttribute() != AccessibilityRole::Menu)
         return nullptr;
-    
+
     return siblingWithAriaRole(node(), "menuitem"_s);
 }
 
@@ -1724,11 +1666,11 @@ AccessibilityObject* AccessibilityNodeObject::captionForFigure() const
 {
     if (!isFigureElement())
         return nullptr;
-    
+
     AXObjectCache* cache = axObjectCache();
     if (!cache)
         return nullptr;
-    
+
     Node* node = this->node();
     for (Node* child = node->firstChild(); child; child = child->nextSibling()) {
         if (child->hasTagName(figcaptionTag))
@@ -1751,34 +1693,60 @@ bool AccessibilityNodeObject::isLabelable() const
     Node* node = this->node();
     if (!node)
         return false;
-    
     return is<HTMLInputElement>(*node) || isControl() || isProgressIndicator() || isMeter();
 }
 
-String AccessibilityNodeObject::textForLabelElements(Vector<Ref<HTMLLabelElement>>&& labelElements) const
+String AccessibilityNodeObject::textAsLabel() const
+{
+    auto labelAttribute = getAttribute(aria_labelAttr);
+    if (!labelAttribute.isEmpty())
+        return labelAttribute;
+
+    labelAttribute = getAttribute(altAttr);
+    if (!labelAttribute.isEmpty())
+        return labelAttribute;
+
+    labelAttribute = getAttribute(titleAttr);
+    if (!labelAttribute.isEmpty())
+        return labelAttribute;
+
+    String text = this->text();
+    if (!text.isEmpty())
+        return text;
+    return textUnderElement();
+}
+
+String AccessibilityNodeObject::textForLabelElements(Vector<Ref<HTMLElement>>&& labelElements) const
 {
-    auto* cache = axObjectCache();
     // https://www.w3.org/TR/html-aam-1.0/#input-type-text-input-type-password-input-type-number-input-type-search-input-type-tel-input-type-email-input-type-url-and-textarea-element-accessible-name-computation
     // "...if more than one label is associated; concatenate by DOM order, delimited by spaces."
     StringBuilder result;
-    for (auto& labelElement : labelElements) {
-        auto appendLabel = [&] (String&& string) {
-            if (string.isEmpty())
-                return;
+    auto appendLabel = [&result] (String&& string) {
+        if (string.isEmpty())
+            return;
 
-            if (!result.isEmpty())
-                result.append(" ");
-            result.append(WTFMove(string));
-        };
+        if (!result.isEmpty())
+            result.append(" ");
+        result.append(WTFMove(string));
+    };
 
-        // Check to see if there's aria-labelledby attribute on the label element.
+    WeakPtr cache = axObjectCache();
+    for (auto& labelElement : labelElements) {
         auto* axLabel = cache ? cache->getOrCreate(labelElement.ptr()) : nullptr;
-        auto ariaLabeledByText = axLabel ? axLabel->ariaLabeledByAttribute() : String();
-        if (!ariaLabeledByText.isEmpty())
-            appendLabel(WTFMove(ariaLabeledByText));
+
+        if (axLabel == this) {
+            // This object labels itself, so use its textAsLabel.
+            appendLabel(textAsLabel());
+            continue;
+        }
+
+        auto ariaLabeledBy = axLabel ? axLabel->ariaLabeledByAttribute() : String();
+        if (!ariaLabeledBy.isEmpty())
+            appendLabel(WTFMove(ariaLabeledBy));
         else
             appendLabel(accessibleNameForNode(labelElement.ptr()));
     }
+
     return result.toString();
 }
 
@@ -1796,34 +1764,36 @@ HTMLLabelElement* AccessibilityNodeObject::labelElementContainer() const
     return nullptr;
 }
 
-void AccessibilityNodeObject::titleElementText(Vector<AccessibilityText>& textOrder) const
+void AccessibilityNodeObject::labelText(Vector<AccessibilityText>& textOrder) const
 {
-    RefPtr node = this->node();
-    if (!node)
+    RefPtr element = this->element();
+    if (!element)
         return;
-    
-    // Only use <label> text if there's no ARIA override.
-    if (isLabelable() && !ariaAccessibilityDescription()) {
-        String labelText = textForLabelElements(labelsForNode(node.get()));
-        if (!labelText.isEmpty()) {
-            textOrder.append(AccessibilityText(WTFMove(labelText), isMeter() ? AccessibilityTextSource::Alternative : AccessibilityTextSource::LabelByElement));
-            return;
-        }
+
+    Vector<Ref<HTMLElement>> elementLabels;
+    auto axLabels = labeledByObjects();
+    if (axLabels.size()) {
+        elementLabels.appendVector(WTF::compactMap(axLabels, [] (auto& axLabel) {
+            return RefPtr { dynamicDowncast<HTMLElement>(axLabel->element()) };
+        }));
     }
-    
-    if (titleUIElement())
-        textOrder.append(AccessibilityText(String(), AccessibilityTextSource::LabelByElement));
-}
+    if (!elementLabels.size())
+        elementLabels = Accessibility::labelsForElement(element.get());
 
-AccessibilityObject* AccessibilityNodeObject::titleUIElement() const
-{
-    // If aria-label is a non-empty string, return null to force clients to use the aria-label.
-    if (!getAttribute(aria_labelAttr).isEmpty())
-        return nullptr;
+    String label = textForLabelElements(WTFMove(elementLabels));
+    if (!label.isEmpty()) {
+        textOrder.append({ WTFMove(label), isMeter() ? AccessibilityTextSource::Alternative : AccessibilityTextSource::LabelByElement });
+        return;
+    }
+
+    auto& ariaLabel = getAttribute(aria_labelAttr);
+    if (!ariaLabel.isEmpty()) {
+        textOrder.append({ ariaLabel.string(), AccessibilityTextSource::LabelByElement });
+        return;
+    }
 
-    if (isFigureElement())
-        return captionForFigure();
-    return axObjectCache()->getOrCreate(labelForNode(node()).get());
+    if (titleUIElement())
+        textOrder.append(AccessibilityText(String(), AccessibilityTextSource::LabelByElement));
 }
 
 bool AccessibilityNodeObject::hasTextAlternative() const
@@ -1841,13 +1811,13 @@ void AccessibilityNodeObject::alternativeText(Vector<AccessibilityText>& textOrd
             textOrder.append(AccessibilityText(webAreaText, AccessibilityTextSource::Alternative));
         return;
     }
-    
+
     ariaLabeledByText(textOrder);
-    
+
     const AtomString& ariaLabel = getAttribute(aria_labelAttr);
     if (!ariaLabel.isEmpty())
         textOrder.append(AccessibilityText(ariaLabel, AccessibilityTextSource::Alternative));
-    
+
     if (usesAltTagForTextComputation()) {
         if (auto* renderImage = dynamicDowncast<RenderImage>(renderer())) {
             String renderAltText = renderImage->altText();
@@ -1864,11 +1834,11 @@ void AccessibilityNodeObject::alternativeText(Vector<AccessibilityText>& textOrd
         if (!alt.isEmpty())
             textOrder.append(AccessibilityText(alt, AccessibilityTextSource::Alternative));
     }
-    
+
     Node* node = this->node();
     if (!node)
         return;
-    
+
     auto objectCache = axObjectCache();
     // The fieldset element derives its alternative text from the first associated legend element if one is available.
     if (RefPtr fieldset = dynamicDowncast<HTMLFieldSetElement>(*node); fieldset && objectCache) {
@@ -1876,18 +1846,18 @@ void AccessibilityNodeObject::alternativeText(Vector<AccessibilityText>& textOrd
         if (object && !object->isHidden())
             textOrder.append(AccessibilityText(accessibleNameForNode(object->node()), AccessibilityTextSource::Alternative));
     }
-    
+
     // The figure element derives its alternative text from the first associated figcaption element if one is available.
     if (isFigureElement()) {
         AccessibilityObject* captionForFigure = this->captionForFigure();
         if (captionForFigure && !captionForFigure->isHidden())
             textOrder.append(AccessibilityText(accessibleNameForNode(captionForFigure->node()), AccessibilityTextSource::Alternative));
     }
-    
+
     // Tree items missing a label are labeled by all child elements.
     if (isTreeItem() && ariaLabel.isEmpty() && ariaLabeledByAttribute().isEmpty())
         textOrder.append(AccessibilityText(accessibleNameForNode(node), AccessibilityTextSource::Alternative));
-    
+
 #if ENABLE(MATHML)
     if (node->isMathMLElement())
         textOrder.append(AccessibilityText(getAttribute(MathMLNames::alttextAttr), AccessibilityTextSource::Alternative));
@@ -1908,9 +1878,9 @@ void AccessibilityNodeObject::visibleText(Vector<AccessibilityText>& textOrder)
     // If this node isn't rendered, there's no inner text we can extract from a select element.
     if (!isAccessibilityRenderObject() && node->hasTagName(selectTag))
         return;
-    
+
     bool useTextUnderElement = false;
-    
+
     switch (roleValue()) {
     case AccessibilityRole::PopUpButton:
         // Native popup buttons should not use their button children's text as a title. That value is retrieved through stringValue().
@@ -1942,18 +1912,18 @@ void AccessibilityNodeObject::visibleText(Vector<AccessibilityText>& textOrder)
     default:
         break;
     }
-    
+
     // If it's focusable but it's not content editable or a known control type, then it will appear to
     // the user as a single atomic object, so we should use its text as the default title.
     if (isHeading() || isLink())
         useTextUnderElement = true;
-    
+
     if (isOutput())
         useTextUnderElement = true;
-    
+
     if (useTextUnderElement) {
         AccessibilityTextUnderElementMode mode;
-        
+
         // Headings often include links as direct children. Those links need to be included in text under element.
         if (isHeading())
             mode.includeFocusableContent = true;
@@ -2006,23 +1976,23 @@ void AccessibilityNodeObject::helpText(Vector<AccessibilityText>& textOrder) con
 
 void AccessibilityNodeObject::accessibilityText(Vector<AccessibilityText>& textOrder) const
 {
-    titleElementText(textOrder);
+    labelText(textOrder);
     alternativeText(textOrder);
     visibleText(textOrder);
     helpText(textOrder);
-    
+
     String placeholder = placeholderValue();
     if (!placeholder.isEmpty())
         textOrder.append(AccessibilityText(placeholder, AccessibilityTextSource::Placeholder));
 }
-    
+
 void AccessibilityNodeObject::ariaLabeledByText(Vector<AccessibilityText>& textOrder) const
 {
     String ariaLabeledBy = ariaLabeledByAttribute();
     if (!ariaLabeledBy.isEmpty())
         textOrder.append(AccessibilityText(ariaLabeledBy, AccessibilityTextSource::Alternative));
 }
-    
+
 String AccessibilityNodeObject::alternativeTextForWebArea() const
 {
     // The WebArea description should follow this order:
@@ -2034,18 +2004,18 @@ String AccessibilityNodeObject::alternativeTextForWebArea() const
     //     aria-label on the <iframe>
     //     title on the <iframe>
     //     name on the <iframe>
-    
+
     Document* document = this->document();
     if (!document)
         return String();
-    
+
     // Check if the HTML element has an aria-label for the webpage.
     if (Element* documentElement = document->documentElement()) {
         const AtomString& ariaLabel = documentElement->attributeWithoutSynchronization(aria_labelAttr);
         if (!ariaLabel.isEmpty())
             return ariaLabel;
     }
-    
+
     if (auto* owner = document->ownerElement()) {
         if (owner->hasTagName(frameTag) || owner->hasTagName(iframeTag)) {
             const AtomString& title = owner->attributeWithoutSynchronization(titleAttr);
@@ -2054,14 +2024,14 @@ String AccessibilityNodeObject::alternativeTextForWebArea() const
         }
         return owner->getNameAttribute();
     }
-    
+
     String documentTitle = document->title();
     if (!documentTitle.isEmpty())
         return documentTitle;
-    
+
     if (auto* body = document->bodyOrFrameset())
         return body->getNameAttribute();
-    
+
     return String();
 }
 
@@ -2076,8 +2046,8 @@ String AccessibilityNodeObject::description() const
         return ariaDescription;
 
     if (usesAltTagForTextComputation()) {
-        // Images should use alt as long as the attribute is present, even if empty.                    
-        // Otherwise, it should fallback to other methods, like the title attribute.                    
+        // Images should use alt as long as the attribute is present, even if empty.
+        // Otherwise, it should fallback to other methods, like the title attribute.
         const AtomString& alt = getAttribute(altAttr);
         if (!alt.isNull())
             return alt;
@@ -2194,7 +2164,7 @@ unsigned AccessibilityNodeObject::hierarchicalLevel() const
     // Only tree item will calculate its level through the DOM currently.
     if (roleValue() != AccessibilityRole::TreeItem)
         return 0;
-    
+
     // Hierarchy leveling starts at 1, to match the aria-level spec.
     // We measure tree hierarchy by the number of groups that the item is within.
     unsigned level = 1;
@@ -2205,7 +2175,7 @@ unsigned AccessibilityNodeObject::hierarchicalLevel() const
         else if (parentRole == AccessibilityRole::Tree)
             break;
     }
-    
+
     return level;
 }
 
@@ -2217,7 +2187,7 @@ void AccessibilityNodeObject::setIsExpanded(bool expand)
             details.toggleOpen();
     }
 }
-    
+
 // When building the textUnderElement for an object, determine whether or not
 // we should include the inner text of this given descendant object or skip it.
 static bool shouldUseAccessibilityObjectInnerText(AccessibilityObject* obj, AccessibilityTextUnderElementMode mode)
@@ -2247,15 +2217,15 @@ static bool shouldUseAccessibilityObjectInnerText(AccessibilityObject* obj, Acce
     if (mode.childrenInclusion == AccessibilityTextUnderElementMode::TextUnderElementModeIncludeNameFromContentsChildren
         && !obj->accessibleNameDerivesFromContent())
         return false;
-    
+
     if (equalLettersIgnoringASCIICase(obj->getAttribute(aria_hiddenAttr), "true"_s))
         return false;
-    
+
     // If something doesn't expose any children, then we can always take the inner text content.
     // This is what we want when someone puts an <a> inside a <button> for example.
     if (obj->isDescendantOfBarrenParent())
         return true;
-    
+
     // Skip focusable children, so we don't include the text of links and controls.
     if (obj->canSetFocusAttribute() && !mode.includeFocusableContent)
         return false;
@@ -2286,7 +2256,7 @@ static bool shouldAddSpaceBeforeAppendingNextElement(StringBuilder& builder, con
     // We don't need to add an additional space before or after a line break.
     return !(isHTMLLineBreak(childText[0]) || isHTMLLineBreak(builder[builder.length() - 1]));
 }
-    
+
 static void appendNameToStringBuilder(StringBuilder& builder, const String& text)
 {
     if (shouldAddSpaceBeforeAppendingNextElement(builder, text))
@@ -2316,13 +2286,13 @@ String AccessibilityNodeObject::textUnderElement(AccessibilityTextUnderElementMo
     for (RefPtr child = firstChild(); child; child = child->nextSibling()) {
         if (mode.ignoredChildNode && child->node() == mode.ignoredChildNode)
             continue;
-        
+
         bool shouldDeriveNameFromAuthor = (mode.childrenInclusion == AccessibilityTextUnderElementMode::TextUnderElementModeIncludeNameFromContentsChildren && !child->accessibleNameDerivesFromContent());
         if (shouldDeriveNameFromAuthor) {
             appendNameToStringBuilder(builder, accessibleNameForNode(child->node()));
             continue;
         }
-        
+
         if (!shouldUseAccessibilityObjectInnerText(child.get(), mode))
             continue;
 
@@ -2333,7 +2303,7 @@ String AccessibilityNodeObject::textUnderElement(AccessibilityTextUnderElementMo
             auto labeledByElements = downcast<AccessibilityNodeObject>(*child).ariaLabeledByElements();
             if (labeledByElements.containsIf([&](auto& element) { return element.ptr() == node; }))
                 continue;
-            
+
             Vector<AccessibilityText> textOrder;
             downcast<AccessibilityNodeObject>(*child).alternativeText(textOrder);
             if (textOrder.size() > 0 && textOrder[0].text.length()) {
@@ -2371,7 +2341,7 @@ String AccessibilityNodeObject::title() const
         return input->valueWithDefault();
 
     if (isLabelable()) {
-        auto labels = labelsForNode(node.get());
+        auto labels = Accessibility::labelsForElement(element());
         // Use the label text as the title if there's no ARIA override.
         if (!labels.isEmpty() && !ariaAccessibilityDescription().length())
             return textForLabelElements(WTFMove(labels));
@@ -2496,8 +2466,8 @@ SRGBA<uint8_t> AccessibilityNodeObject::colorValue() const
 #endif
 }
 
-// This function implements the ARIA accessible name as described by the Mozilla                                        
-// ARIA Implementer's Guide.                                                                                            
+// This function implements the ARIA accessible name as described by the Mozilla
+// ARIA Implementer's Guide.
 static String accessibleNameForNode(Node* node, Node* labelledbyNode)
 {
     ASSERT(node);
@@ -2506,7 +2476,7 @@ static String accessibleNameForNode(Node* node, Node* labelledbyNode)
     const AtomString& ariaLabel = element ? element->attributeWithoutSynchronization(aria_labelAttr) : nullAtom();
     if (!ariaLabel.isEmpty())
         return ariaLabel;
-    
+
     const AtomString& alt = element ? element->attributeWithoutSynchronization(altAttr) : nullAtom();
     if (!alt.isEmpty())
         return alt;
@@ -2566,7 +2536,7 @@ static String accessibleNameForNode(Node* node, Node* labelledbyNode)
 
     if (!text.isEmpty())
         return text;
-    
+
     const AtomString& title = element ? element->attributeWithoutSynchronization(titleAttr) : nullAtom();
     if (!title.isEmpty())
         return title;
@@ -2582,7 +2552,7 @@ static String accessibleNameForNode(Node* node, Node* labelledbyNode)
         if (!assignedNodesText.isEmpty())
             return assignedNodesText;
     }
-    
+
     return String();
 }
 
@@ -2721,7 +2691,7 @@ bool AccessibilityNodeObject::canSetFocusAttribute() const
 
     if (isWebArea())
         return true;
-    
+
     // NOTE: It would be more accurate to ask the document whether setFocusedElement() would
     // do anything. For example, setFocusedElement() will do nothing if the current focused
     // node will not relinquish the focus.
@@ -2812,11 +2782,11 @@ AccessibilityRole AccessibilityNodeObject::determineAriaRoleAttribute() const
     }
 
     role = remapAriaRoleDueToParent(role);
-    
+
     // Presentational roles are invalidated by the presence of ARIA attributes.
     if (role == AccessibilityRole::Presentational && supportsARIAAttributes())
         role = AccessibilityRole::Unknown;
-    
+
     // https://w3c.github.io/aria/#document-handling_author-errors_roles
     // In situations where an author has not specified names for the form and
     // region landmarks, it is considered an authoring error. The user agent
@@ -2833,27 +2803,27 @@ AccessibilityRole AccessibilityNodeObject::determineAriaRoleAttribute() const
 AccessibilityRole AccessibilityNodeObject::remapAriaRoleDueToParent(AccessibilityRole role) const
 {
     // Some objects change their role based on their parent.
-    // However, asking for the unignoredParent calls accessibilityIsIgnored(), which can trigger a loop. 
+    // However, asking for the unignoredParent calls accessibilityIsIgnored(), which can trigger a loop.
     // While inside the call stack of creating an element, we need to avoid accessibilityIsIgnored().
     // https://bugs.webkit.org/show_bug.cgi?id=65174
 
     if (role != AccessibilityRole::ListBoxOption && role != AccessibilityRole::MenuItem)
         return role;
-    
+
     for (AccessibilityObject* parent = parentObject(); parent && !parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
         AccessibilityRole parentAriaRole = parent->ariaRoleAttribute();
 
         // Selects and listboxes both have options as child roles, but they map to different roles within WebCore.
         if (role == AccessibilityRole::ListBoxOption && parentAriaRole == AccessibilityRole::Menu)
             return AccessibilityRole::MenuItem;
-        
+
         // If the parent had a different role, then we don't need to continue searching up the chain.
         if (parentAriaRole != AccessibilityRole::Unknown)
             break;
     }
-    
+
     return role;
-}   
+}
 
 bool AccessibilityNodeObject::canSetSelectedAttribute() const
 {
@@ -2877,4 +2847,50 @@ bool AccessibilityNodeObject::canSetSelectedAttribute() const
     }
 }
 
+namespace Accessibility {
+
+RefPtr<HTMLElement> controlForLabelElement(const HTMLLabelElement& label)
+{
+    auto control = label.control();
+    // Make sure the corresponding control isn't a descendant of this label that's in the middle of being destroyed.
+    if (!control || (control->renderer() && !control->renderer()->parent()))
+        return nullptr;
+    return control;
+}
+
+Vector<Ref<HTMLElement>> labelsForElement(Element* element)
+{
+    RefPtr htmlElement = dynamicDowncast<HTMLElement>(element);
+    if (!htmlElement || !htmlElement->isLabelable())
+        return { };
+
+    Vector<Ref<HTMLElement>> result;
+    const auto& idAttribute = htmlElement->getIdAttribute();
+    if (!idAttribute.isEmpty()) {
+        if (htmlElement->hasAttributeWithoutSynchronization(aria_labelAttr))
+            return { };
+
+        if (auto* treeScopeLabels = htmlElement->treeScope().labelElementsForId(idAttribute); treeScopeLabels && !treeScopeLabels->isEmpty()) {
+            result.appendVector(WTF::compactMap(*treeScopeLabels, [] (auto& label) {
+                return RefPtr { dynamicDowncast<HTMLLabelElement>(label.get()) };
+            }));
+            if (result.size())
+                return result;
+        }
+    }
+
+    if (htmlElement->hasAttributeWithoutSynchronization(aria_labelAttr))
+        return { };
+
+    if (RefPtr nearestLabel = ancestorsOfType<HTMLLabelElement>(*htmlElement).first()) {
+        // Only use the nearest label if it isn't pointing at something else.
+        const auto& forAttribute = nearestLabel->attributeWithoutSynchronization(forAttr);
+        if (forAttribute.isEmpty() || forAttribute == idAttribute)
+            return { nearestLabel.releaseNonNull() };
+    }
+    return { };
+}
+
+} // namespace Accessibility
+
 } // namespace WebCore
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.h b/Source/WebCore/accessibility/AccessibilityNodeObject.h
index d206bfb61a28..9807bfc86296 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.h
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.h
@@ -33,7 +33,7 @@
 #include <wtf/Forward.h>
 
 namespace WebCore {
-    
+
 class AXObjectCache;
 class Element;
 class HTMLLabelElement;
@@ -193,9 +193,9 @@ class AccessibilityNodeObject : public AccessibilityObject {
 
     String accessKey() const final;
     bool isLabelable() const;
-    AccessibilityObject* correspondingControlForLabelElement() const override;
-    AccessibilityObject* correspondingLabelForControlElement() const override;
-    String textForLabelElements(Vector<Ref<HTMLLabelElement>>&&) const;
+    AccessibilityObject* controlForLabelElement() const final;
+    String textAsLabel() const;
+    String textForLabelElements(Vector<Ref<HTMLElement>>&&) const;
     HTMLLabelElement* labelElementContainer() const;
 
     String ariaAccessibilityDescription() const;
@@ -208,9 +208,7 @@ class AccessibilityNodeObject : public AccessibilityObject {
     Element* menuItemElementForMenu() const;
     AccessibilityObject* menuButtonForMenu() const;
     AccessibilityObject* captionForFigure() const;
-    virtual void titleElementText(Vector<AccessibilityText>&) const;
-    AccessibilityObject* titleUIElement() const override;
-
+    virtual void labelText(Vector<AccessibilityText>&) const;
 private:
     bool isAccessibilityNodeObject() const final { return true; }
     void accessibilityText(Vector<AccessibilityText>&) const override;
@@ -234,6 +232,13 @@ class AccessibilityNodeObject : public AccessibilityObject {
     WeakPtr<Node, WeakPtrImplWithEventTargetData> m_node;
 };
 
+namespace Accessibility {
+
+RefPtr<HTMLElement> controlForLabelElement(const HTMLLabelElement&);
+Vector<Ref<HTMLElement>> labelsForElement(Element*);
+
+} // namespace Accessibility
+
 } // namespace WebCore
 
 SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::AccessibilityNodeObject) \
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index ce636f20f14a..d75cf9ae0bd1 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -363,7 +363,7 @@ String AccessibilityObject::computedLabel()
     accessibilityText(text);
     if (text.size())
         return text[0].text;
-    return String();
+    return { };
 }
 
 bool AccessibilityObject::isARIATextControl() const
@@ -2496,7 +2496,7 @@ bool AccessibilityObject::hasAttribute(const QualifiedName& attribute) const
 
     return false;
 }
-    
+
 const AtomString& AccessibilityObject::getAttribute(const QualifiedName& attribute) const
 {
     if (RefPtr element = this->element()) {
@@ -3000,10 +3000,7 @@ String AccessibilityObject::keyShortcuts() const
 
 Element* AccessibilityObject::element() const
 {
-    Node* node = this->node();
-    if (is<Element>(node))
-        return downcast<Element>(node);
-    return nullptr;
+    return dynamicDowncast<Element>(node());
 }
 
 const RenderStyle* AccessibilityObject::style() const
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index c7f28d5c3b55..a92ecdf7f515 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -109,6 +109,7 @@ class AccessibilityObject : public AXCoreObject, public CanMakeWeakPtr<Accessibi
     bool isAccessibilityARIAGridInstance() const override { return false; }
     bool isAccessibilityARIAGridRowInstance() const override { return false; }
     bool isAccessibilityARIAGridCellInstance() const override { return false; }
+    virtual bool isAccessibilityLabelInstance() const { return false; }
     virtual bool isAccessibilityListBoxInstance() const { return false; }
     bool isAXIsolatedObjectInstance() const override { return false; }
 
@@ -125,7 +126,7 @@ class AccessibilityObject : public AXCoreObject, public CanMakeWeakPtr<Accessibi
     bool isInputImage() const override { return false; }
     virtual bool isSliderThumb() const { return false; }
     bool isControl() const override { return false; }
-    virtual bool isLabel() const { return false; }
+    bool isLabel() const { return isAccessibilityLabelInstance() || labelForObjects().size(); }
 
     bool isList() const override { return false; }
     virtual bool isUnorderedList() const { return false; }
@@ -348,9 +349,7 @@ class AccessibilityObject : public AXCoreObject, public CanMakeWeakPtr<Accessibi
 
     virtual AccessibilityObject* observableObject() const { return nullptr; }
     AccessibilityChildrenVector linkedObjects() const override { return { }; }
-    AccessibilityObject* titleUIElement() const override { return nullptr; }
-    AccessibilityObject* correspondingLabelForControlElement() const override { return nullptr; }
-    AccessibilityObject* correspondingControlForLabelElement() const override { return nullptr; }
+    virtual AccessibilityObject* controlForLabelElement() const { return nullptr; }
     AccessibilityObject* scrollBar(AccessibilityOrientation) override { return nullptr; }
 
     virtual AccessibilityRole ariaRoleAttribute() const { return AccessibilityRole::Unknown; }
diff --git a/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp b/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp
index d7d66ed717b7..ffb98e14724d 100644
--- a/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp
+++ b/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp
@@ -117,7 +117,7 @@ float AccessibilityProgressIndicator::minValueForRange() const
 
     return 0.0;
 }
-    
+
 AccessibilityRole AccessibilityProgressIndicator::determineAccessibilityRole()
 {
     if (meterElement())
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index f738e89b42aa..0c272a4954c7 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -980,7 +980,7 @@ String AccessibilityRenderObject::applePayButtonDescription() const
 }
 #endif
 
-void AccessibilityRenderObject::titleElementText(Vector<AccessibilityText>& textOrder) const
+void AccessibilityRenderObject::labelText(Vector<AccessibilityText>& textOrder) const
 {
 #if ENABLE(APPLE_PAY)
     if (isApplePayButton()) {
@@ -988,11 +988,10 @@ void AccessibilityRenderObject::titleElementText(Vector<AccessibilityText>& text
         return;
     }
 #endif
-
-    AccessibilityNodeObject::titleElementText(textOrder);
+    AccessibilityNodeObject::labelText(textOrder);
 }
-    
-AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
+
+AXCoreObject* AccessibilityRenderObject::titleUIElement() const
 {
     if (m_renderer && isFieldset())
         return axObjectCache()->getOrCreate(dynamicDowncast<RenderBlock>(m_renderer.get())->findFieldsetLegend(RenderBlock::FieldsetIncludeFloatingOrOutOfFlow));
@@ -1340,7 +1339,7 @@ bool AccessibilityRenderObject::computeAccessibilityIsIgnored() const
 
     // Find out if this element is inside of a label element.
     // If so, it may be ignored because it's the label for a checkbox or radio button.
-    auto* controlObject = correspondingControlForLabelElement();
+    auto* controlObject = controlForLabelElement();
     if (controlObject && controlObject->isCheckboxOrRadio() && !controlObject->titleUIElement())
         return true;
 
@@ -2030,10 +2029,10 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityHitTest(const IntPo
     result->updateChildrenIfNecessary();
     // Allow the element to perform any hit-testing it might need to do to reach non-render children.
     result = result->elementAccessibilityHitTest(point);
-    
+
     if (result && result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
-        auto* controlObject = result->correspondingControlForLabelElement();
+        auto* controlObject = result->controlForLabelElement();
         if (controlObject && !controlObject->titleUIElement())
             return controlObject;
 
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.h b/Source/WebCore/accessibility/AccessibilityRenderObject.h
index be9ee4f86046..30c475164297 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.h
@@ -78,7 +78,7 @@ class AccessibilityRenderObject : public AccessibilityNodeObject {
     AccessibilityObject* parentObject() const override;
     AccessibilityObject* parentObjectIfExists() const override;
     AccessibilityObject* observableObject() const override;
-    AccessibilityObject* titleUIElement() const override;
+    AXCoreObject* titleUIElement() const override;
 
     // Should be called on the root accessibility object to kick off a hit test.
     AccessibilityObject* accessibilityHitTest(const IntPoint&) const override;
@@ -133,7 +133,7 @@ class AccessibilityRenderObject : public AccessibilityNodeObject {
     IntRect doAXBoundsForRangeUsingCharacterOffset(const CharacterRange&) const override;
     
     String secureFieldValue() const override;
-    void titleElementText(Vector<AccessibilityText>&) const override;
+    void labelText(Vector<AccessibilityText>&) const override;
 
 protected:
     explicit AccessibilityRenderObject(RenderObject*);
diff --git a/Source/WebCore/accessibility/AccessibilityTable.cpp b/Source/WebCore/accessibility/AccessibilityTable.cpp
index fcf534a16e0e..62a41b30b5f1 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.cpp
+++ b/Source/WebCore/accessibility/AccessibilityTable.cpp
@@ -892,7 +892,7 @@ bool AccessibilityTable::computeAccessibilityIsIgnored() const
     return false;
 }
 
-void AccessibilityTable::titleElementText(Vector<AccessibilityText>& textOrder) const
+void AccessibilityTable::labelText(Vector<AccessibilityText>& textOrder) const
 {
     String title = this->title();
     if (!title.isEmpty())
diff --git a/Source/WebCore/accessibility/AccessibilityTable.h b/Source/WebCore/accessibility/AccessibilityTable.h
index cbf58cbc07e7..a753e43e9b91 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.h
+++ b/Source/WebCore/accessibility/AccessibilityTable.h
@@ -109,7 +109,7 @@ class AccessibilityTable : public AccessibilityRenderObject {
 
 private:
     virtual bool computeIsTableExposableThroughAccessibility() const;
-    void titleElementText(Vector<AccessibilityText>&) const final;
+    void labelText(Vector<AccessibilityText>&) const final;
     HTMLTableElement* tableElement() const;
 
     void ensureRow(unsigned);
diff --git a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
index d1e695e0d6a9..52ecd533d3df 100644
--- a/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
+++ b/Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp
@@ -1035,10 +1035,7 @@ RelationMap AccessibilityObjectAtspi::relationMap() const
     };
 
     AccessibilityObject::AccessibilityChildrenVector ariaLabelledByElements;
-    if (m_coreObject->isControl()) {
-        if (auto* label = m_coreObject->correspondingLabelForControlElement())
-            ariaLabelledByElements.append(label);
-    } else if (m_coreObject->isFieldset()) {
+    if (m_coreObject->isControl() || m_coreObject->isFieldset()) {
         if (auto* label = m_coreObject->titleUIElement())
             ariaLabelledByElements.append(label);
     } else if (m_coreObject->roleValue() == AccessibilityRole::Legend) {
@@ -1046,17 +1043,14 @@ RelationMap AccessibilityObjectAtspi::relationMap() const
             if (renderFieldset->isFieldset())
                 ariaLabelledByElements.append(m_coreObject->axObjectCache()->getOrCreate(renderFieldset));
         }
-    } else if (!m_coreObject->correspondingControlForLabelElement())
-        ariaLabelledByElements = m_coreObject->labelledByObjects();
+    } else {
+        auto* liveObject = dynamicDowncast<AccessibilityObject>(m_coreObject);
+        if (liveObject && !liveObject->controlForLabelElement())
+            ariaLabelledByElements = m_coreObject->labeledByObjects();
+    }
     addRelation(Atspi::Relation::LabelledBy, ariaLabelledByElements);
 
-    AccessibilityObject::AccessibilityChildrenVector labelForObjects;
-    if (auto* control = m_coreObject->correspondingControlForLabelElement())
-        labelForObjects.append(control);
-    else
-        labelForObjects = m_coreObject->labelForObjects();
-    addRelation(Atspi::Relation::LabelFor, labelForObjects);
-
+    addRelation(Atspi::Relation::LabelFor, m_coreObject->labelForObjects());
     addRelation(Atspi::Relation::FlowsTo, m_coreObject->flowToObjects());
     addRelation(Atspi::Relation::FlowsFrom, m_coreObject->flowFromObjects());
 
diff --git a/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm b/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm
index 46aedac97bce..b19753d8f55c 100644
--- a/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm
+++ b/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm
@@ -1253,16 +1253,16 @@ - (NSString *)accessibilityLabel
         }
     }
 
-    // iOS doesn't distinguish between a title and description field,
-    // so concatentation will yield the best result.
-    NSString *axTitle = backingObject->titleAttributeValue();
-    NSString *axDescription = backingObject->descriptionAttributeValue();
+    // iOS doesn't distinguish between the title and description properties,
+    // so concatenate them when different.
+    String title = backingObject->titleAttributeValue();
+    String description = backingObject->descriptionAttributeValue();
     NSString *landmarkDescription = [self ariaLandmarkRoleDescription];
     NSString *interactiveVideoDescription = [self interactiveVideoDescription];
 
     // We should expose the value of the input type date or time through AXValue instead of AXTitle.
-    if (backingObject->isInputTypePopupButton() && [axTitle isEqualToString:[self accessibilityValue]])
-        axTitle = nil;
+    if (backingObject->isInputTypePopupButton() && title == String([self accessibilityValue]))
+        title = ""_s;
 
     // Footer is not considered a landmark, but we want the role description.
     if (backingObject->roleValue() == AccessibilityRole::Footer)
@@ -1272,8 +1272,9 @@ - (NSString *)accessibilityLabel
     if (backingObject->roleValue() == AccessibilityRole::HorizontalRule)
         appendStringToResult(result, AXHorizontalRuleDescriptionText());
 
-    appendStringToResult(result, axTitle);
-    appendStringToResult(result, axDescription);
+    appendStringToResult(result, title);
+    if (description != title)
+        appendStringToResult(result, description);
     if ([self stringValueShouldBeUsedInLabel]) {
         NSString *valueLabel = backingObject->stringValue();
         valueLabel = [valueLabel stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]];
diff --git a/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp b/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
index 108f508b1080..013052e480db 100644
--- a/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
+++ b/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
@@ -145,7 +145,6 @@ void AXIsolatedObject::initializeProperties(const Ref<AccessibilityObject>& axOb
     setProperty(AXPropertyName::SupportsDragging, object.supportsDragging());
     setProperty(AXPropertyName::SupportsPressAction, object.supportsPressAction());
     setProperty(AXPropertyName::IsGrabbed, object.isGrabbed());
-    setObjectProperty(AXPropertyName::TitleUIElement, object.titleUIElement());
     setProperty(AXPropertyName::PlaceholderValue, object.placeholderValue().isolatedCopy());
     setProperty(AXPropertyName::ExpandedTextValue, object.expandedTextValue().isolatedCopy());
     setProperty(AXPropertyName::SupportsExpandedTextValue, object.supportsExpandedTextValue());
@@ -1738,18 +1737,6 @@ bool AXIsolatedObject::isDescendantOfRole(AccessibilityRole) const
     return false;
 }
 
-AXCoreObject* AXIsolatedObject::correspondingLabelForControlElement() const
-{
-    ASSERT_NOT_REACHED();
-    return nullptr;
-}
-
-AXCoreObject* AXIsolatedObject::correspondingControlForLabelElement() const
-{
-    ASSERT_NOT_REACHED();
-    return nullptr;
-}
-
 bool AXIsolatedObject::inheritsPresentationalRole() const
 {
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h b/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h
index bf89c13f368b..2041c41a3901 100644
--- a/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h
+++ b/Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h
@@ -255,7 +255,6 @@ class AXIsolatedObject final : public AXCoreObject {
     AXIsolatedObject* accessibilityHitTest(const IntPoint&) const final;
     AXIsolatedObject* focusedUIElement() const final;
     AccessibilityChildrenVector linkedObjects() const final { return tree()->objectsForIDs(vectorAttributeValue<AXID>(AXPropertyName::LinkedObjects)); }
-    AXIsolatedObject* titleUIElement() const final { return objectAttributeValue(AXPropertyName::TitleUIElement); }
     AXIsolatedObject* scrollBar(AccessibilityOrientation) final;
     const String placeholderValue() const final { return stringAttributeValue(AXPropertyName::PlaceholderValue); }
     String expandedTextValue() const final { return stringAttributeValue(AXPropertyName::ExpandedTextValue); }
@@ -482,8 +481,6 @@ class AXIsolatedObject final : public AXCoreObject {
     bool supportsChecked() const final;
     bool isModalNode() const final;
     bool isDescendantOfRole(AccessibilityRole) const final;
-    AXCoreObject* correspondingLabelForControlElement() const final;
-    AXCoreObject* correspondingControlForLabelElement() const final;
     bool inheritsPresentationalRole() const final;
     void setAccessibleName(const AtomString&) final;
 
diff --git a/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp b/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
index b7726b052e77..25d3c26ca373 100644
--- a/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
+++ b/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp
@@ -667,11 +667,6 @@ void AXIsolatedTree::updateNodeProperties(AXCoreObject& axObject, const AXProper
             propertyMap.set(AXPropertyName::TextInputMarkedTextMarkerRange, value);
             break;
         }
-        case AXPropertyName::TitleUIElement: {
-            auto* titleUIElement = axObject.titleUIElement();
-            propertyMap.set(AXPropertyName::TitleUIElement, titleUIElement ? titleUIElement->objectID() : AXID());
-            break;
-        }
         case AXPropertyName::URL:
             propertyMap.set(AXPropertyName::URL, axObject.url().isolatedCopy());
             break;
@@ -701,25 +696,29 @@ void AXIsolatedTree::overrideNodeProperties(AXID axID, AXPropertyMap&& propertyM
     m_pendingPropertyChanges.append({ axID, WTFMove(propertyMap) });
 }
 
-void AXIsolatedTree::updateNodeAndDependentProperties(AccessibilityObject& axObject)
+void AXIsolatedTree::updateDependentProperties(AccessibilityObject& axObject)
 {
     ASSERT(isMainThread());
 
-    updateNode(axObject);
-
-    if (RefPtr correspondingControl = axObject.isLabel() ? axObject.correspondingControlForLabelElement() : nullptr)
-        updateNode(*correspondingControl);
+    auto updateLabeledObjects = [this] (const AccessibilityObject& label) {
+        auto labeledObjects = label.labelForObjects();
+        for (auto& labeledObject : labeledObjects) {
+            if (RefPtr axObject = dynamicDowncast<AccessibilityObject>(labeledObject.get()))
+                updateNode(*axObject);
+        }
+    };
+    updateLabeledObjects(axObject);
 
     // When a row gains or loses cells, the column count of the table can change.
     bool updateTableAncestorColumns = is<AccessibilityTableRow>(axObject);
-    for (auto* ancestor = axObject.parentObject(); ancestor; ancestor = ancestor->parentObject()) {
+    for (RefPtr ancestor = axObject.parentObject(); ancestor; ancestor = ancestor->parentObject()) {
         if (ancestor->isTree()) {
             queueNodeUpdate(*ancestor, { AXPropertyName::ARIATreeRows });
             if (!updateTableAncestorColumns)
                 break;
         }
 
-        if (updateTableAncestorColumns && ancestor->isAccessibilityTableInstance()) {
+        if (updateTableAncestorColumns && is<AccessibilityTable>(*ancestor)) {
             // Only `updateChildren` if the table is unignored, because otherwise `updateChildren` will ascend and update the next highest unignored ancestor, which doesn't accomplish our goal of updating table columns.
             if (ancestor->accessibilityIsIgnored())
                 break;
@@ -727,6 +726,8 @@ void AXIsolatedTree::updateNodeAndDependentProperties(AccessibilityObject& axObj
             updateChildren(*ancestor, ResolveNodeChanges::No);
             break;
         }
+
+        updateLabeledObjects(*ancestor);
     }
 }
 
@@ -861,8 +862,10 @@ void AXIsolatedTree::updateChildren(AccessibilityObject& axObject, ResolveNodeCh
     };
 
     // Also queue updates to the target node itself and any properties that depend on children().
-    if (childrenChanged || unconditionallyUpdate(axAncestor->roleValue()))
-        updateNodeAndDependentProperties(*axAncestor);
+    if (childrenChanged || unconditionallyUpdate(axAncestor->roleValue())) {
+        updateNode(*axAncestor);
+        updateDependentProperties(*axAncestor);
+    }
 
     if (resolveNodeChanges == ResolveNodeChanges::Yes)
         queueRemovalsAndUnresolvedChanges(WTFMove(oldChildrenIDs));
@@ -977,13 +980,6 @@ void AXIsolatedTree::setSelectedTextMarkerRange(AXTextMarkerRange&& range)
     m_selectedTextMarkerRange = range;
 }
 
-void AXIsolatedTree::labelCreated(AccessibilityObject& axObject)
-{
-    ASSERT(axObject.isLabel());
-    if (RefPtr correspondingControl = axObject.isLabel() ? axObject.correspondingControlForLabelElement() : nullptr)
-        queueNodeUpdate(*correspondingControl, NodeUpdateOptions::nodeUpdate());
-}
-
 void AXIsolatedTree::updateLoadingProgress(double newProgressValue)
 {
     AXTRACE("AXIsolatedTree::updateLoadingProgress"_s);
@@ -1013,7 +1009,7 @@ void AXIsolatedTree::removeNode(const AccessibilityObject& axObject)
     AXLOG(makeString("objectID ", axObject.objectID().loggingString()));
     ASSERT(isMainThread());
 
-    if (RefPtr correspondingControl = axObject.isLabel() ? axObject.correspondingControlForLabelElement() : nullptr) {
+    if (RefPtr correspondingControl = axObject.isLabel() ? axObject.controlForLabelElement() : nullptr) {
         // If a label has been removed from the AX tree, the control associated it may need to change
         // its title UI element. Use callOnMainThread to spin the runloop before re-computing this,
         // as we need to wait for the backing DOM element to actually be destroyed to compute the
diff --git a/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h b/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h
index 7e8f6178159b..4879caad2332 100644
--- a/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h
+++ b/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h
@@ -239,7 +239,6 @@ enum class AXPropertyName : uint16_t {
 #endif
     Title,
     TitleAttributeValue,
-    TitleUIElement,
     URL,
     ValueAutofillButtonType,
     ValueDescription,
@@ -340,14 +339,13 @@ class AXIsolatedTree : public ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr<AX
     }
 
     void generateSubtree(AccessibilityObject&);
-    void labelCreated(AccessibilityObject&);
     void updateNode(AccessibilityObject&);
     enum class ResolveNodeChanges : bool { No, Yes };
     void updateChildren(AccessibilityObject&, ResolveNodeChanges = ResolveNodeChanges::Yes);
     void updateChildrenForObjects(const ListHashSet<RefPtr<AccessibilityObject>>&);
     void updateNodeProperty(AXCoreObject& object, AXPropertyName property) { updateNodeProperties(object, { property }); };
     void updateNodeProperties(AXCoreObject&, const AXPropertyNameSet&);
-    void updateNodeAndDependentProperties(AccessibilityObject&);
+    void updateDependentProperties(AccessibilityObject&);
     void updatePropertiesForSelfAndDescendants(AccessibilityObject&, const AXPropertyNameSet&);
     void updateFrame(AXID, IntRect&&);
     void overrideNodeProperties(AXID, AXPropertyMap&&);
diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
index dc98d073a31e..e59d0b2ac574 100644
--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
@@ -1997,6 +1997,7 @@ - (id)accessibilityAttributeValue:(NSString*)attributeName
     }
 
     if ([attributeName isEqualToString:NSAccessibilityTitleUIElementAttribute]) {
+        // FIXME: change to return an array instead of a single object.
         auto* object = backingObject->titleUIElement();
         return object ? object->wrapper() : nil;
     }
@@ -2274,7 +2275,7 @@ - (id)accessibilityAttributeValue:(NSString*)attributeName
         return makeNSArray(backingObject->flowToObjects());
 
     if (UNLIKELY([attributeName isEqualToString:@"AXLabelledBy"]))
-        return makeNSArray(backingObject->labelledByObjects());
+        return makeNSArray(backingObject->labeledByObjects());
 
     if (UNLIKELY([attributeName isEqualToString:@"AXLabelFor"]))
         return makeNSArray(backingObject->labelForObjects());