From 140bedf39fef858771bd4127e75caa7482ed3a41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Arrufat?= <adria.arrufat@gmail.com>
Date: Thu, 24 Sep 2026 15:39:16 +0200
Subject: [PATCH 1/3] mem: AXNode tree, query and isIgnore walks -> iterative

Follow-up to the SemanticTree change: the CDP accessibility writer still
recursed once per DOM level in writeNodeChildren (getFullAXTree /
getPartialAXTree), walkQuery (queryAXTree) and isIgnore (chains of
generic div/span containers). In a debug build, a 100k-deep chain
overflows the 8MB main-thread stack in the tree writer and in isIgnore.

The tree and query walks now share an allocation-free pre-order Walker
that counts aria-hidden ancestors instead of threading the flag through
the recursion. isIgnore splits into a shallow per-node verdict
(ignoreSelf) and a TreeWalker pass over generic containers that skips
ignored subtrees.

Output is byte-identical to the recursive version.
---
 src/server/cdp/AXNode.zig | 176 ++++++++++++++++++++++++--------------
 1 file changed, 112 insertions(+), 64 deletions(-)

diff --git a/src/server/cdp/AXNode.zig b/src/server/cdp/AXNode.zig
index af0fc17e0..f98eb2db0 100644
--- a/src/server/cdp/AXNode.zig
+++ b/src/server/cdp/AXNode.zig
@@ -82,13 +82,11 @@ pub const Writer = struct {
     fn toJSON(self: *const Writer, w: anytype) !void {
         try w.beginArray();
         if (self.filter != null) {
-            try self.walkQuery(self.root.dom, false, w);
+            try self.walkQuery(self.root.dom, w);
         } else {
             const root = AXNode.fromNode(self.root.dom);
             const root_hidden = if (self.root.dom.is(DOMNode.Element)) |el| isHidden(el, self.frame, .{}) else false;
-            if (try self.writeNode(self.root.id, root, false, root_hidden, w)) {
-                try self.writeNodeChildren(root, false, w);
-            }
+            try self.writeTree(root, root_hidden, w);
         }
         return w.endArray();
     }
@@ -118,28 +116,27 @@ pub const Writer = struct {
         try w.write(s);
     }
 
-    fn writeNodeChildren(self: *const Writer, parent: AXNode, in_aria_hidden: bool, w: anytype) !void {
-        // Add ListMarker for listitem elements
-        if (parent.dom.is(DOMNode.Element)) |parent_el| {
-            if (parent_el.getTag() == .li) {
-                try self.writeListMarker(parent.dom, w);
+    fn writeTree(self: *const Writer, root: AXNode, root_hidden: bool, w: anytype) !void {
+        var walker: Walker = .init(root.dom);
+        var axn = root;
+        var descend = try self.writeNode(self.root.id, root, false, root_hidden, w);
+        while (true) {
+            if (descend) {
+                if (axn.dom.is(DOMNode.Element)) |el| {
+                    if (el.getTag() == .li) {
+                        try self.writeListMarker(axn.dom, w);
+                    }
+                }
             }
-        }
 
-        const child_in_aria_hidden = in_aria_hidden or blk: {
-            const parent_el = parent.dom.is(DOMNode.Element) orelse break :blk false;
-            break :blk hasAriaHiddenTrue(parent_el);
-        };
-
-        var it = parent.dom.childrenIterator();
-        const ignore_text = ignoreText(parent.dom);
-        while (it.next()) |dom_node| {
+            const dom_node = walker.next(descend) orelse return;
+            descend = false;
             switch (dom_node._type) {
                 .cdata => {
                     if (dom_node.is(DOMNode.CData.Text) == null) {
                         continue;
                     }
-                    if (ignore_text) {
+                    if (ignoreText(dom_node._parent.?)) {
                         continue;
                     }
                 },
@@ -147,8 +144,8 @@ pub const Writer = struct {
                     // Prune hidden subtrees entirely (display:none,
                     // visibility:hidden, aria-hidden, hidden, inert). Matches
                     // Chromium: these elements aren't exposed to the AX tree.
-                    const child_el = dom_node.as(DOMNode.Element);
-                    if (child_in_aria_hidden or isHidden(child_el, self.frame, .{ .ancestors = false })) {
+                    const el = dom_node.as(DOMNode.Element);
+                    if (walker.inAriaHidden() or isHidden(el, self.frame, .{ .ancestors = false })) {
                         continue;
                     }
                 },
@@ -156,10 +153,8 @@ pub const Writer = struct {
             }
 
             const node = try self.registry.register(dom_node);
-            const axn = AXNode.fromNode(node.dom);
-            if (try self.writeNode(node.id, axn, child_in_aria_hidden, false, w)) {
-                try self.writeNodeChildren(axn, child_in_aria_hidden, w);
-            }
+            axn = AXNode.fromNode(node.dom);
+            descend = try self.writeNode(node.id, axn, walker.inAriaHidden(), false, w);
         }
     }
 
@@ -591,7 +586,7 @@ pub const Writer = struct {
                 }
 
                 // Skip hidden element children so childIds matches the
-                // subtree-pruning done in writeNodeChildren.
+                // subtree-pruning done in writeTree.
                 if (child.is(DOMNode.Element)) |child_el| {
                     if (child_in_aria_hidden or isHidden(child_el, self.frame, .{ .ancestors = false })) {
                         continue;
@@ -648,25 +643,21 @@ pub const Writer = struct {
 
     // Query-mode walk. Visits every node under `root` (including AX-ignored
     // ones, per the queryAXTree spec) and defers emission to emitMatch.
-    fn walkQuery(self: *const Writer, node: *DOMNode, in_aria_hidden: bool, w: anytype) !void {
-        const axn = AXNode.fromNode(node);
-        try self.emitMatch(axn, in_aria_hidden, w);
+    fn walkQuery(self: *const Writer, root: *DOMNode, w: anytype) !void {
+        var walker: Walker = .init(root);
+        var node = root;
+        while (true) {
+            const axn = AXNode.fromNode(node);
+            try self.emitMatch(axn, walker.inAriaHidden(), w);
 
-        // <head>, <script>, <style> never expose AX content — skip recursion.
-        if (axn.ignoreChildren()) return;
-
-        const child_in_aria_hidden = in_aria_hidden or blk: {
-            const parent_el = node.is(DOMNode.Element) orelse break :blk false;
-            break :blk hasAriaHiddenTrue(parent_el);
-        };
-
-        var it = node.childrenIterator();
-        while (it.next()) |child| {
-            switch (child._type) {
-                .element, .cdata => {},
-                else => continue,
-            }
-            try self.walkQuery(child, child_in_aria_hidden, w);
+            // <head>, <script>, <style> never expose AX content — skip their children.
+            var descend = !axn.ignoreChildren();
+            node = while (walker.next(descend)) |next| {
+                switch (next._type) {
+                    .element, .cdata => break next,
+                    else => descend = false,
+                }
+            } else return;
         }
     }
 
@@ -1131,6 +1122,51 @@ fn writeAccessibleNameFallback(node: *DOMNode, writer: *std.Io.Writer) !void {
     }
 }
 
+/// Pre-order walk of a subtree's descendants that tracks whether one of the
+/// current node's ancestors (the root included) is aria-hidden. Iterative, so
+/// a deep DOM can't overflow the native stack.
+const Walker = struct {
+    root: *DOMNode,
+    current: *DOMNode,
+    aria_hidden_ancestors: u32 = 0,
+
+    fn init(root: *DOMNode) Walker {
+        return .{ .root = root, .current = root };
+    }
+
+    /// The node after the current one, entering its children only if `descend`.
+    fn next(self: *Walker, descend: bool) ?*DOMNode {
+        if (descend) {
+            if (self.current.firstChild()) |child| {
+                if (isAriaHidden(self.current)) self.aria_hidden_ancestors += 1;
+                self.current = child;
+                return child;
+            }
+        }
+
+        var node = self.current;
+        while (node != self.root) {
+            if (node.nextSibling()) |sibling| {
+                self.current = sibling;
+                return sibling;
+            }
+            node = node._parent.?;
+            if (isAriaHidden(node)) self.aria_hidden_ancestors -= 1;
+        }
+        self.current = self.root;
+        return null;
+    }
+
+    fn inAriaHidden(self: *const Walker) bool {
+        return self.aria_hidden_ancestors > 0;
+    }
+
+    fn isAriaHidden(node: *DOMNode) bool {
+        const el = node.is(DOMNode.Element) orelse return false;
+        return hasAriaHiddenTrue(el);
+    }
+};
+
 fn hasAriaHiddenTrue(elt: *DOMNode.Element) bool {
     if (elt.getAttributeInterned("aria-hidden")) |value| {
         return std.mem.eql(u8, value, "true");
@@ -1325,14 +1361,36 @@ fn ignoreChildren(self: AXNode) bool {
 // `hidden` comes from the caller: the tree walk prunes, so its children never
 // are; the root and the query walk probe the whole chain.
 fn isIgnore(self: AXNode, frame: *Frame, in_aria_hidden: bool, hidden: bool) bool {
+    return switch (self.ignoreSelf(in_aria_hidden, hidden)) {
+        .ignored => true,
+        .exposed => false,
+        // A generic container is ignored unless it has a non-ignored
+        // descendant, reached through other generic containers.
+        .generic => {
+            var tw = TreeWalker.FullExcludeSelf.init(self.dom, .{});
+            while (tw.next()) |node| {
+                const node_hidden = if (node.is(DOMNode.Element)) |el| isHidden(el, frame, .{ .ancestors = false }) else false;
+                switch (AXNode.fromNode(node).ignoreSelf(in_aria_hidden, node_hidden)) {
+                    .ignored => tw.skipChildren(),
+                    .exposed => return false,
+                    .generic => {},
+                }
+            }
+            return true;
+        },
+    };
+}
+
+/// isIgnore for `self` alone, leaving generic containers to the caller.
+fn ignoreSelf(self: AXNode, in_aria_hidden: bool, hidden: bool) enum { ignored, exposed, generic } {
     const node = self.dom;
     const role_attr = self.role_attr;
 
     // Don't ignore non-Element node: CData, Document...
-    const elt = node.is(DOMNode.Element) orelse return in_aria_hidden;
+    const elt = node.is(DOMNode.Element) orelse return if (in_aria_hidden) .ignored else .exposed;
     // Ignore non-HTML elements: svg...
     if (elt._type != .html) {
-        return true;
+        return .ignored;
     }
 
     const tag = elt.getTag();
@@ -1341,20 +1399,20 @@ fn isIgnore(self: AXNode, frame: *Frame, in_aria_hidden: bool, hidden: bool) boo
         .script, .style, .meta, .link, .title, .base, .head, .noscript,
         .template, .param, .source, .track, .datalist, .col, .colgroup, .html,
         .body
-        => return true,
+        => return .ignored,
         // zig fmt: on
         .img => {
             // Check for empty decorative images
             const alt_ = elt.getAttributeInterned("alt");
             if (alt_ == null or alt_.?.len == 0) {
-                return true;
+                return .ignored;
             }
         },
         .input => {
             // Check for hidden inputs
             const input = elt.as(DOMNode.Element.Html.Input);
             if (input._input_type == .hidden) {
-                return true;
+                return .ignored;
             }
         },
         else => {},
@@ -1362,16 +1420,16 @@ fn isIgnore(self: AXNode, frame: *Frame, in_aria_hidden: bool, hidden: bool) boo
 
     if (role_attr) |role| {
         if (std.ascii.eqlIgnoreCase(role, "none") or std.ascii.eqlIgnoreCase(role, "presentation")) {
-            return true;
+            return .ignored;
         }
     }
 
     if (in_aria_hidden) {
-        return true;
+        return .ignored;
     }
 
     if (hidden) {
-        return true;
+        return .ignored;
     }
 
     // Generic containers with no semantic value
@@ -1381,21 +1439,11 @@ fn isIgnore(self: AXNode, frame: *Frame, in_aria_hidden: bool, hidden: bool) boo
         const has_aria_labelledby = elt.hasAttributeSafe(.wrap("aria-labelledby"));
 
         if (!has_role and !has_aria_label and !has_aria_labelledby) {
-            // Check if it has any non-ignored children.
-            var it = node.childrenIterator();
-            while (it.next()) |child| {
-                const axn = AXNode.fromNode(child);
-                const child_hidden = if (child.is(DOMNode.Element)) |child_el| isHidden(child_el, frame, .{ .ancestors = false }) else false;
-                if (!axn.isIgnore(frame, in_aria_hidden, child_hidden)) {
-                    return false;
-                }
-            }
-
-            return true;
+            return .generic;
         }
     }
 
-    return false;
+    return .exposed;
 }
 
 pub fn getRole(self: AXNode) ![]const u8 {

From 555415da887af5a1ce4431be8a91486d8e522b1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Arrufat?= <adria.arrufat@gmail.com>
Date: Thu, 24 Sep 2026 16:02:16 +0200
Subject: [PATCH 2/3] perf: memoize AXNode isIgnore for generic containers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A div/span with no role or label is ignored unless a non-ignored node
sits under it through other generic containers. The tree writer asks
that of every node, so each generic container rescanned the chain below
it: O(depth²). A 20k-deep div chain took 5.5s in getFullAXTree.

Answers are now cached per walk. A scan marks every generic container it
enters as ignored, then flips the ones on the path to the exposed node
it stops at. Later questions hit the cache, so the walk is linear:
20k-deep chain 5.5s -> 12.5ms, 2k-deep 46ms -> 1.3ms (ReleaseFast).
Output is byte-identical.
---
 src/server/cdp/AXNode.zig | 111 +++++++++++++++++++++++++++++---------
 1 file changed, 85 insertions(+), 26 deletions(-)

diff --git a/src/server/cdp/AXNode.zig b/src/server/cdp/AXNode.zig
index f98eb2db0..8b0447a25 100644
--- a/src/server/cdp/AXNode.zig
+++ b/src/server/cdp/AXNode.zig
@@ -80,13 +80,14 @@ pub const Writer = struct {
     }
 
     fn toJSON(self: *const Writer, w: anytype) !void {
+        var ignore_cache: IgnoreCache = .empty;
         try w.beginArray();
         if (self.filter != null) {
-            try self.walkQuery(self.root.dom, w);
+            try self.walkQuery(self.root.dom, &ignore_cache, w);
         } else {
             const root = AXNode.fromNode(self.root.dom);
             const root_hidden = if (self.root.dom.is(DOMNode.Element)) |el| isHidden(el, self.frame, .{}) else false;
-            try self.writeTree(root, root_hidden, w);
+            try self.writeTree(root, root_hidden, &ignore_cache, w);
         }
         return w.endArray();
     }
@@ -116,10 +117,10 @@ pub const Writer = struct {
         try w.write(s);
     }
 
-    fn writeTree(self: *const Writer, root: AXNode, root_hidden: bool, w: anytype) !void {
+    fn writeTree(self: *const Writer, root: AXNode, root_hidden: bool, ignore_cache: *IgnoreCache, w: anytype) !void {
         var walker: Walker = .init(root.dom);
         var axn = root;
-        var descend = try self.writeNode(self.root.id, root, false, root_hidden, w);
+        var descend = try self.writeNode(self.root.id, root, false, root_hidden, ignore_cache, w);
         while (true) {
             if (descend) {
                 if (axn.dom.is(DOMNode.Element)) |el| {
@@ -154,7 +155,7 @@ pub const Writer = struct {
 
             const node = try self.registry.register(dom_node);
             axn = AXNode.fromNode(node.dom);
-            descend = try self.writeNode(node.id, axn, walker.inAriaHidden(), false, w);
+            descend = try self.writeNode(node.id, axn, walker.inAriaHidden(), false, ignore_cache, w);
         }
     }
 
@@ -490,7 +491,7 @@ pub const Writer = struct {
     }
 
     // write a node. returns true if children must be written.
-    fn writeNode(self: *const Writer, id: u32, axn: AXNode, in_aria_hidden: bool, hidden: bool, w: anytype) !bool {
+    fn writeNode(self: *const Writer, id: u32, axn: AXNode, in_aria_hidden: bool, hidden: bool, ignore_cache: *IgnoreCache, w: anytype) !bool {
         // ignore empty texts
         try w.beginObject();
 
@@ -506,7 +507,7 @@ pub const Writer = struct {
         try w.objectField("role");
         try self.writeAXValue(.{ .role = resolved.role }, w);
 
-        const ignore = axn.isIgnore(self.frame, in_aria_hidden, hidden);
+        const ignore = try axn.isIgnore(self.frame, in_aria_hidden, hidden, ignore_cache);
         try w.objectField("ignored");
         try w.write(ignore);
 
@@ -643,12 +644,12 @@ pub const Writer = struct {
 
     // Query-mode walk. Visits every node under `root` (including AX-ignored
     // ones, per the queryAXTree spec) and defers emission to emitMatch.
-    fn walkQuery(self: *const Writer, root: *DOMNode, w: anytype) !void {
+    fn walkQuery(self: *const Writer, root: *DOMNode, ignore_cache: *IgnoreCache, w: anytype) !void {
         var walker: Walker = .init(root);
         var node = root;
         while (true) {
             const axn = AXNode.fromNode(node);
-            try self.emitMatch(axn, walker.inAriaHidden(), w);
+            try self.emitMatch(axn, walker.inAriaHidden(), ignore_cache, w);
 
             // <head>, <script>, <style> never expose AX content — skip their children.
             var descend = !axn.ignoreChildren();
@@ -665,7 +666,7 @@ pub const Writer = struct {
     // the queryAXTree flat-match shape: nodeId, backendDOMNodeId, ignored,
     // role, name, plus empty properties / childIds (clients fetch full
     // properties via getFullAXTree on a matched nodeId).
-    fn emitMatch(self: *const Writer, axn: AXNode, in_aria_hidden: bool, w: anytype) !void {
+    fn emitMatch(self: *const Writer, axn: AXNode, in_aria_hidden: bool, ignore_cache: *IgnoreCache, w: anytype) !void {
         const filter = self.filter.?;
         const resolved = self.resolveRole(axn) catch return;
 
@@ -680,7 +681,7 @@ pub const Writer = struct {
 
         const node = try self.registry.register(axn.dom);
         const hidden = if (axn.dom.is(DOMNode.Element)) |el| isHidden(el, self.frame, .{}) else false;
-        const ignored = axn.isIgnore(self.frame, in_aria_hidden, hidden);
+        const ignored = try axn.isIgnore(self.frame, in_aria_hidden, hidden, ignore_cache);
 
         try w.beginObject();
 
@@ -1358,29 +1359,57 @@ fn ignoreChildren(self: AXNode) bool {
     };
 }
 
+// Generic containers are ignored unless a non-ignored node sits under them
+// through other generic containers. Asking that of every node in a deep chain
+// is quadratic, so the answers are memoized for the duration of one walk.
+const IgnoreCache = std.AutoHashMapUnmanaged(*DOMNode, bool);
+
 // `hidden` comes from the caller: the tree walk prunes, so its children never
 // are; the root and the query walk probe the whole chain.
-fn isIgnore(self: AXNode, frame: *Frame, in_aria_hidden: bool, hidden: bool) bool {
+fn isIgnore(self: AXNode, frame: *Frame, in_aria_hidden: bool, hidden: bool, cache: *IgnoreCache) !bool {
     return switch (self.ignoreSelf(in_aria_hidden, hidden)) {
         .ignored => true,
         .exposed => false,
-        // A generic container is ignored unless it has a non-ignored
-        // descendant, reached through other generic containers.
-        .generic => {
-            var tw = TreeWalker.FullExcludeSelf.init(self.dom, .{});
-            while (tw.next()) |node| {
-                const node_hidden = if (node.is(DOMNode.Element)) |el| isHidden(el, frame, .{ .ancestors = false }) else false;
-                switch (AXNode.fromNode(node).ignoreSelf(in_aria_hidden, node_hidden)) {
-                    .ignored => tw.skipChildren(),
-                    .exposed => return false,
-                    .generic => {},
-                }
-            }
-            return true;
-        },
+        .generic => isGenericIgnored(self.dom, frame, cache),
     };
 }
 
+/// Only reached outside aria-hidden (ignoreSelf would have said .ignored), so
+/// the answer depends on the node alone.
+fn isGenericIgnored(root: *DOMNode, frame: *Frame, cache: *IgnoreCache) !bool {
+    const allocator = frame.call_arena;
+    if (cache.get(root)) |ignored| return ignored;
+    // Every generic container the scan enters is provisionally ignored: it is
+    // unless it's an ancestor of the exposed node that ends the scan.
+    try cache.put(allocator, root, true);
+
+    var tw = TreeWalker.FullExcludeSelf.init(root, .{});
+    const exposed = while (tw.next()) |node| {
+        const node_hidden = if (node.is(DOMNode.Element)) |el| isHidden(el, frame, .{ .ancestors = false }) else false;
+        switch (AXNode.fromNode(node).ignoreSelf(false, node_hidden)) {
+            .ignored => tw.skipChildren(),
+            .exposed => break node,
+            .generic => {
+                const gop = try cache.getOrPut(allocator, node);
+                if (!gop.found_existing) {
+                    gop.value_ptr.* = true;
+                } else if (gop.value_ptr.*) {
+                    tw.skipChildren();
+                } else {
+                    break node;
+                }
+            },
+        }
+    } else return true;
+
+    var node = exposed;
+    while (node != root) {
+        node = node._parent.?;
+        try cache.put(allocator, node, false);
+    }
+    return false;
+}
+
 /// isIgnore for `self` alone, leaving generic containers to the caller.
 fn ignoreSelf(self: AXNode, in_aria_hidden: bool, hidden: bool) enum { ignored, exposed, generic } {
     const node = self.dom;
@@ -2085,3 +2114,33 @@ test "AXNode: writer prunes children when root is hidden" {
     try testing.expect(std.mem.indexOf(u8, json, "under-display-none") == null);
     try testing.expect(std.mem.indexOf(u8, json, "\"childIds\":[]") != null);
 }
+
+test "AXNode: generic containers share memoized ignore answers" {
+    var registry = NodeRegistry.init(testing.allocator);
+    defer registry.deinit();
+
+    const frame = try testing.base.createFrame();
+    defer testing.base.test_session.closeAllPages();
+
+    const root = try frame.window._document.createElement("div", null, frame);
+    // Scanning #a provisionally ignores #b, #c and #d; the text under #d then
+    // flips #c and #d, while #b (only a decorative image) stays ignored.
+    try root.setInnerHTML(
+        \\<div id="a"><div id="b"><img></div><div id="c"><span id="d">text</span></div></div>
+    , frame);
+
+    var cache: IgnoreCache = .empty;
+    const expected = [_]struct { []const u8, bool }{ .{ "#a", false }, .{ "#b", true }, .{ "#c", false }, .{ "#d", false } };
+    for (expected) |e| {
+        const el = (try root.querySelector(e[0], frame)).?;
+        try testing.expectEqual(e[1], try AXNode.fromNode(el.asNode()).isIgnore(frame, false, false, &cache));
+    }
+    // Every answer after #a's came from the one scan.
+    try testing.expectEqual(4, cache.count());
+
+    var fresh: IgnoreCache = .empty;
+    for (expected[1..]) |e| {
+        const el = (try root.querySelector(e[0], frame)).?;
+        try testing.expectEqual(e[1], try AXNode.fromNode(el.asNode()).isIgnore(frame, false, false, &fresh));
+    }
+}

From 0d3dfa50f8b969f5a8b0a6ba2665836f8a6648bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Arrufat?= <adria.arrufat@gmail.com>
Date: Thu, 24 Sep 2026 16:16:25 +0200
Subject: [PATCH 3/3] AXNode: simplify iterative walks and scope the ignore
 cache to one call

The list marker is written by writeNode, so writeTree and walkQuery share
one loop shape. IgnoreCache lives on its own pooled arena for the call
instead of frame.call_arena, which only resets on JS calls. The scan no
longer caches its root, which is never asked about again.
---
 src/server/cdp/AXNode.zig | 166 ++++++++++++++++++--------------------
 1 file changed, 77 insertions(+), 89 deletions(-)

diff --git a/src/server/cdp/AXNode.zig b/src/server/cdp/AXNode.zig
index 8b0447a25..b336bd9cf 100644
--- a/src/server/cdp/AXNode.zig
+++ b/src/server/cdp/AXNode.zig
@@ -80,7 +80,10 @@ pub const Writer = struct {
     }
 
     fn toJSON(self: *const Writer, w: anytype) !void {
-        var ignore_cache: IgnoreCache = .empty;
+        const cache_arena = try self.frame.getArena(.medium, "AXNode.IgnoreCache");
+        defer cache_arena.release();
+        var ignore_cache: IgnoreCache = .{ .allocator = cache_arena.allocator() };
+
         try w.beginArray();
         if (self.filter != null) {
             try self.walkQuery(self.root.dom, &ignore_cache, w);
@@ -119,18 +122,8 @@ pub const Writer = struct {
 
     fn writeTree(self: *const Writer, root: AXNode, root_hidden: bool, ignore_cache: *IgnoreCache, w: anytype) !void {
         var walker: Walker = .init(root.dom);
-        var axn = root;
         var descend = try self.writeNode(self.root.id, root, false, root_hidden, ignore_cache, w);
-        while (true) {
-            if (descend) {
-                if (axn.dom.is(DOMNode.Element)) |el| {
-                    if (el.getTag() == .li) {
-                        try self.writeListMarker(axn.dom, w);
-                    }
-                }
-            }
-
-            const dom_node = walker.next(descend) orelse return;
+        while (walker.next(descend)) |dom_node| {
             descend = false;
             switch (dom_node._type) {
                 .cdata => {
@@ -154,8 +147,7 @@ pub const Writer = struct {
             }
 
             const node = try self.registry.register(dom_node);
-            axn = AXNode.fromNode(node.dom);
-            descend = try self.writeNode(node.id, axn, walker.inAriaHidden(), false, ignore_cache, w);
+            descend = try self.writeNode(node.id, .fromNode(dom_node), walker.inAriaHidden(), false, ignore_cache, w);
         }
     }
 
@@ -492,7 +484,6 @@ pub const Writer = struct {
 
     // write a node. returns true if children must be written.
     fn writeNode(self: *const Writer, id: u32, axn: AXNode, in_aria_hidden: bool, hidden: bool, ignore_cache: *IgnoreCache, w: anytype) !bool {
-        // ignore empty texts
         try w.beginObject();
 
         try w.objectField("nodeId");
@@ -602,6 +593,14 @@ pub const Writer = struct {
 
         try w.endObject();
 
+        if (write_children) {
+            if (n.is(DOMNode.Element)) |el| {
+                if (el.getTag() == .li) {
+                    try self.writeListMarker(n, w);
+                }
+            }
+        }
+
         return write_children;
     }
 
@@ -646,19 +645,19 @@ pub const Writer = struct {
     // ones, per the queryAXTree spec) and defers emission to emitMatch.
     fn walkQuery(self: *const Writer, root: *DOMNode, ignore_cache: *IgnoreCache, w: anytype) !void {
         var walker: Walker = .init(root);
-        var node = root;
-        while (true) {
-            const axn = AXNode.fromNode(node);
+        const root_axn: AXNode = .fromNode(root);
+        try self.emitMatch(root_axn, false, ignore_cache, w);
+        // <head>, <script>, <style> never expose AX content — skip their children.
+        var descend = !root_axn.ignoreChildren();
+        while (walker.next(descend)) |node| {
+            descend = false;
+            switch (node._type) {
+                .element, .cdata => {},
+                else => continue,
+            }
+            const axn: AXNode = .fromNode(node);
             try self.emitMatch(axn, walker.inAriaHidden(), ignore_cache, w);
-
-            // <head>, <script>, <style> never expose AX content — skip their children.
-            var descend = !axn.ignoreChildren();
-            node = while (walker.next(descend)) |next| {
-                switch (next._type) {
-                    .element, .cdata => break next,
-                    else => descend = false,
-                }
-            } else return;
+            descend = !axn.ignoreChildren();
         }
     }
 
@@ -1123,9 +1122,8 @@ fn writeAccessibleNameFallback(node: *DOMNode, writer: *std.Io.Writer) !void {
     }
 }
 
-/// Pre-order walk of a subtree's descendants that tracks whether one of the
-/// current node's ancestors (the root included) is aria-hidden. Iterative, so
-/// a deep DOM can't overflow the native stack.
+/// Pre-order walk counting aria-hidden ancestors (root included), which
+/// TreeWalker can't: it leaves subtrees without saying so.
 const Walker = struct {
     root: *DOMNode,
     current: *DOMNode,
@@ -1135,7 +1133,7 @@ const Walker = struct {
         return .{ .root = root, .current = root };
     }
 
-    /// The node after the current one, entering its children only if `descend`.
+    /// `descend` false skips the current node's children.
     fn next(self: *Walker, descend: bool) ?*DOMNode {
         if (descend) {
             if (self.current.firstChild()) |child| {
@@ -1154,7 +1152,6 @@ const Walker = struct {
             node = node._parent.?;
             if (isAriaHidden(node)) self.aria_hidden_ancestors -= 1;
         }
-        self.current = self.root;
         return null;
     }
 
@@ -1359,64 +1356,59 @@ fn ignoreChildren(self: AXNode) bool {
     };
 }
 
-// Generic containers are ignored unless a non-ignored node sits under them
-// through other generic containers. Asking that of every node in a deep chain
-// is quadratic, so the answers are memoized for the duration of one walk.
-const IgnoreCache = std.AutoHashMapUnmanaged(*DOMNode, bool);
+// A generic container's answer depends on the ones below it; without a memo,
+// a walk asking about every node of a deep chain is O(depth²).
+const IgnoreCache = struct {
+    allocator: std.mem.Allocator,
+    map: std.AutoHashMapUnmanaged(*DOMNode, bool) = .empty,
 
-// `hidden` comes from the caller: the tree walk prunes, so its children never
-// are; the root and the query walk probe the whole chain.
+    /// Keyed on the node alone: never reached under aria-hidden (ignoreSelf
+    /// says .ignored). `root` isn't cached, walks ask about each node once.
+    fn isGenericIgnored(self: *IgnoreCache, root: *DOMNode, frame: *Frame) !bool {
+        if (self.map.get(root)) |ignored| return ignored;
+
+        var tw = TreeWalker.FullExcludeSelf.init(root, .{});
+        const exposed = while (tw.next()) |node| {
+            const node_hidden = if (node.is(DOMNode.Element)) |el| isHidden(el, frame, .{ .ancestors = false }) else false;
+            switch (AXNode.fromNode(node).ignoreSelf(false, node_hidden)) {
+                .ignored => tw.skipChildren(),
+                .exposed => break node,
+                .generic => {
+                    // Until an exposed node turns up under it.
+                    const gop = try self.map.getOrPut(self.allocator, node);
+                    if (!gop.found_existing) {
+                        gop.value_ptr.* = true;
+                    } else if (gop.value_ptr.*) {
+                        tw.skipChildren();
+                    } else {
+                        break node;
+                    }
+                },
+            }
+        } else return true;
+
+        var node = exposed._parent.?;
+        while (node != root) : (node = node._parent.?) {
+            self.map.getPtr(node).?.* = false;
+        }
+        return false;
+    }
+};
+
+/// `hidden` comes from the caller: the tree walk prunes, so its children never
+/// are; the root and the query walk probe the whole chain.
 fn isIgnore(self: AXNode, frame: *Frame, in_aria_hidden: bool, hidden: bool, cache: *IgnoreCache) !bool {
     return switch (self.ignoreSelf(in_aria_hidden, hidden)) {
         .ignored => true,
         .exposed => false,
-        .generic => isGenericIgnored(self.dom, frame, cache),
+        .generic => cache.isGenericIgnored(self.dom, frame),
     };
 }
 
-/// Only reached outside aria-hidden (ignoreSelf would have said .ignored), so
-/// the answer depends on the node alone.
-fn isGenericIgnored(root: *DOMNode, frame: *Frame, cache: *IgnoreCache) !bool {
-    const allocator = frame.call_arena;
-    if (cache.get(root)) |ignored| return ignored;
-    // Every generic container the scan enters is provisionally ignored: it is
-    // unless it's an ancestor of the exposed node that ends the scan.
-    try cache.put(allocator, root, true);
-
-    var tw = TreeWalker.FullExcludeSelf.init(root, .{});
-    const exposed = while (tw.next()) |node| {
-        const node_hidden = if (node.is(DOMNode.Element)) |el| isHidden(el, frame, .{ .ancestors = false }) else false;
-        switch (AXNode.fromNode(node).ignoreSelf(false, node_hidden)) {
-            .ignored => tw.skipChildren(),
-            .exposed => break node,
-            .generic => {
-                const gop = try cache.getOrPut(allocator, node);
-                if (!gop.found_existing) {
-                    gop.value_ptr.* = true;
-                } else if (gop.value_ptr.*) {
-                    tw.skipChildren();
-                } else {
-                    break node;
-                }
-            },
-        }
-    } else return true;
-
-    var node = exposed;
-    while (node != root) {
-        node = node._parent.?;
-        try cache.put(allocator, node, false);
-    }
-    return false;
-}
-
 /// isIgnore for `self` alone, leaving generic containers to the caller.
 fn ignoreSelf(self: AXNode, in_aria_hidden: bool, hidden: bool) enum { ignored, exposed, generic } {
-    const node = self.dom;
-    const role_attr = self.role_attr;
-
     // Don't ignore non-Element node: CData, Document...
-    const elt = node.is(DOMNode.Element) orelse return if (in_aria_hidden) .ignored else .exposed;
+    const elt = self.dom.is(DOMNode.Element) orelse return if (in_aria_hidden) .ignored else .exposed;
     // Ignore non-HTML elements: svg...
     if (elt._type != .html) {
         return .ignored;
@@ -1447,7 +1439,7 @@ fn ignoreSelf(self: AXNode, in_aria_hidden: bool, hidden: bool) enum { ignored,
         else => {},
     }
 
-    if (role_attr) |role| {
+    if (self.role_attr) |role| {
         if (std.ascii.eqlIgnoreCase(role, "none") or std.ascii.eqlIgnoreCase(role, "presentation")) {
             return .ignored;
         }
@@ -2116,29 +2108,25 @@ test "AXNode: writer prunes children when root is hidden" {
 }
 
 test "AXNode: generic containers share memoized ignore answers" {
-    var registry = NodeRegistry.init(testing.allocator);
-    defer registry.deinit();
-
     const frame = try testing.base.createFrame();
     defer testing.base.test_session.closeAllPages();
 
     const root = try frame.window._document.createElement("div", null, frame);
-    // Scanning #a provisionally ignores #b, #c and #d; the text under #d then
-    // flips #c and #d, while #b (only a decorative image) stays ignored.
+    // #b holds only a decorative image; the text under #d exposes #c and #d.
     try root.setInnerHTML(
         \\<div id="a"><div id="b"><img></div><div id="c"><span id="d">text</span></div></div>
     , frame);
 
-    var cache: IgnoreCache = .empty;
+    var cache: IgnoreCache = .{ .allocator = testing.arena_allocator };
     const expected = [_]struct { []const u8, bool }{ .{ "#a", false }, .{ "#b", true }, .{ "#c", false }, .{ "#d", false } };
     for (expected) |e| {
         const el = (try root.querySelector(e[0], frame)).?;
         try testing.expectEqual(e[1], try AXNode.fromNode(el.asNode()).isIgnore(frame, false, false, &cache));
     }
-    // Every answer after #a's came from the one scan.
-    try testing.expectEqual(4, cache.count());
+    // Filled by #a's scan.
+    try testing.expectEqual(3, cache.map.count());
 
-    var fresh: IgnoreCache = .empty;
+    var fresh: IgnoreCache = .{ .allocator = testing.arena_allocator };
     for (expected[1..]) |e| {
         const el = (try root.querySelector(e[0], frame)).?;
         try testing.expectEqual(e[1], try AXNode.fromNode(el.asNode()).isIgnore(frame, false, false, &fresh));