From 15248c94bc3d90896e0a56d66ebc3a362318fe49 Mon Sep 17 00:00:00 2001
From: Sky Debreuil <[email protected]>
Date: Tue, 13 Oct 2026 18:10:24 -0700
Subject: [PATCH] [a11y] Copy title attribute value in AXNodeObject

Store the title attribute in a local AtomicString rather than a
reference in AXNodeObject::Description(), and take it by value in
AXNodeObject::TextAlternativeFromTitleAttribute(), matching how other
attribute reads in Blink avoid holding references into element
attribute storage across calls that may update it.

Change-Id: Ie67fb6fd2bcddf55d5bfe506a4d33d8e5f1f5efd
Bug: 571618833
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8551193
Reviewed-by: Lucas Radaelli <[email protected]>
Auto-Submit: Sky Debreuil <[email protected]>
Reviewed-by: David Tseng <[email protected]>
Commit-Queue: Sky Debreuil <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1718179}
---
diff --git a/third_party/blink/renderer/modules/accessibility/ax_node_object.cc b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
index e1060dc1d..710189e 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
@@ -7205,7 +7205,7 @@
 }
 
 String AXNodeObject::TextAlternativeFromTitleAttribute(
-    const AtomicString& title,
+    AtomicString title,
     ax::mojom::blink::NameFrom& name_from,
     NameSources* name_sources,
     bool* found_text_alternative) const {
@@ -8159,7 +8159,8 @@
           DescriptionSource(found_description, kTitleAttr));
       description_sources->back().type = description_from;
     }
-    const AtomicString& title = element->FastGetAttribute(kTitleAttr);
+    // Copy title as computing inner text can modify the attribute storage.
+    const AtomicString title = element->FastGetAttribute(kTitleAttr);
     if (!title.empty() &&
         String(title).StripWhiteSpace() !=
             element->GetInnerTextWithoutUpdate().StripWhiteSpace()) {
diff --git a/third_party/blink/renderer/modules/accessibility/ax_node_object.h b/third_party/blink/renderer/modules/accessibility/ax_node_object.h
index 50f6df6..8503b53 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_node_object.h
+++ b/third_party/blink/renderer/modules/accessibility/ax_node_object.h
@@ -399,8 +399,9 @@
       String* text_alternative,
       AXRelatedObjectVector* related_objects) const;
 
+  // Takes title by value as computing inner text can modify attribute storage.
   String TextAlternativeFromTitleAttribute(
-      const AtomicString& title,
+      AtomicString title,
       ax::mojom::blink::NameFrom& name_from,
       NameSources* name_sources,
       bool* found_text_alternative) const;