REGRESSION(305794@main): Unconditional CheckedPtr crash when loading any Reddit post with VoiceOver active

[twilco]

54845b1

REGRESSION(305794@main): Unconditional CheckedPtr crash when loading any Reddit post with VoiceOver active
https://bugs.webkit.org/show_bug.cgi?id=308467
rdar://170985963

Reviewed by Chris Fleizach.

Narrow the scope of the CheckedPtr<RenderStyle> in AccessibilityNodeObject::textUnderElement
(added in 305794@main)so it does not live across the child iteration loop.

Previously, a CheckedPtr to the element's RenderStyle was captured at the
top of the function and held until return. During child iteration,
getOrCreate for a sibling slot element can trigger computedStyle() ->
resolveComputedStyle(), which walks the ancestor chain and re-resolves
the parent's m_computedStyle. This destroys the old RenderStyle that the
CheckedPtr still references, resulting in a crash (EXC_GUARD from
CheckedPtr accessing a scribbled-over object).

This happens specifically for display:none shadow hosts with slot
children, where a shadow-scoped stylesheet update sets
IsComputedStyleInvalidFlag on the host and slots. The flag is never
cleared by the style tree resolver because display:none subtrees without
renderers are not visited during resolveStyle, and
updateLayoutIgnorePendingStylesheets considers style clean despite the
flag persisting on non-rendered elements.

* LayoutTests/accessibility/shadow-host-style-invalidation-during-text-under-element-crash-expected.txt: Added.
* LayoutTests/accessibility/shadow-host-style-invalidation-during-text-under-element-crash.html: Added.
* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::textUnderElement const):

Canonical link: https://commits.webkit.org/308173@main

e95970b

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	💥 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	💥 🧪 win-tests	🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	❌ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

[webkit-early-warning-system]

EWS run on current version of this PR (hash e95970b)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	💥 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	💥 🧪 win-tests	🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	❌ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

[webkit-commit-queue]

Committed 308173@main (54845b1): https://commits.webkit.org/308173@main

Reviewed commits have been landed. Closing PR #59243 and removing active labels.