In accessible/base/nsAccessibilityService.cpp, in GetRootDocumentAccessible (https://searchfox.org/mozilla-central/source/accessible/base/nsAccessibilityService.cpp#341):
The logic uses
GetInProcessRootTreeItem to obtain the root and check if it is the same as the current tree item. If it is not the same (current item is not the root), then the presShell variable is replaced with the PresShell of the current document.
However, in a post-fission world, it can occur such that the "in-process root" is the same as the current item, but the actual root is out of process. In this case, we would erroneously skip this assignment, and use the presShell provided in the argument.
The fix here seems like it should be the following:
GetInProcessParent to obtain the parent.
- If it's null, then the current item is either the true root, or it is the child of an out-of-process item.
- In the case that it is null, use BrowsingContext to obtain information about whether there exists an out-of-process parent.
- If an out-of-process parent exists, then this item cannot be the true root.
- If the OOP parent does not exist, then this item is the true root.
- Adjust conditional logic accordingly.