Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ca82e8080fe03ee8363136aff9ec0c1b4a683b78
https://github.com/WebKit/WebKit/commit/ca82e8080fe03ee8363136aff9ec0c1b4a683b78
Author: Tyler Wilcock <[email protected]>
Date: 2026-06-11 (Thu, 11 Jun 2026)
Changed paths:
A
LayoutTests/accessibility/search-predicate-ignored-start-backward-expected.txt
A LayoutTests/accessibility/search-predicate-ignored-start-backward.html
A
LayoutTests/accessibility/search-predicate-ignored-start-no-loop-to-top-expected.txt
A
LayoutTests/accessibility/search-predicate-ignored-start-no-loop-to-top.html
A
LayoutTests/accessibility/search-predicate-ignored-start-non-immediate-expected.txt
A
LayoutTests/accessibility/search-predicate-ignored-start-non-immediate.html
A
LayoutTests/accessibility/search-predicate-ignored-start-relative-search-key-expected.txt
A
LayoutTests/accessibility/search-predicate-ignored-start-relative-search-key.html
M LayoutTests/platform/glib/TestExpectations
M Source/WebCore/accessibility/AXCoreObject.cpp
M Source/WebCore/accessibility/AXCoreObject.h
M Source/WebCore/accessibility/AXSearchManager.cpp
Log Message:
-----------
AX: VoiceOver can jump to the top of the page when navigating to an element
that immediately becomes ignored via JS
https://bugs.webkit.org/show_bug.cgi?id=316617
rdar://179065364
Reviewed by Dominic Mazzoni.
VoiceOver's AnyType navigation (VO-Right) uses the accessibility search
predicate
with immediateDescendantsOnly=YES. To find the next element, AXSearchManager's
appendChildrenToArray() locates the start object among the container's unignored
children (crossFrameUnignoredChildren()) and collects the children after it.
When the start object can't be located in those children, appendChildrenToArray
fell
through to returning the first child for a forward search, which can potentially
move a VoiceOver user very far back in the page.
The start object can fail to be located when it became ignored after a dynamic
update. For example, a previous navigation could trigger a JS event handler that
makes an element become ignored.
In this scenario, rather than starting the walk from an object that can no
longer be
located, resolve the positioning start up front to the nearest unignored
element in
the resume direction: the unignored element just before the start for a forward
search, just after it for a backward search, found by stepping through the
including-ignored tree (previousInPreOrder()/nextInPreOrder()). The existing
parent-walk then resumes from there as usual.
criteria.startObject is deliberately left unchanged, so relative search keys
(SameType, DifferentType, HeadingSameLevel, and similar) still compare
candidates
against the original start rather than the resolved neighbor.
*
LayoutTests/accessibility/search-predicate-ignored-start-backward-expected.txt:
Added.
* LayoutTests/accessibility/search-predicate-ignored-start-backward.html: Added.
*
LayoutTests/accessibility/search-predicate-ignored-start-no-loop-to-top-expected.txt:
Added.
* LayoutTests/accessibility/search-predicate-ignored-start-no-loop-to-top.html:
Added.
*
LayoutTests/accessibility/search-predicate-ignored-start-non-immediate-expected.txt:
Added.
* LayoutTests/accessibility/search-predicate-ignored-start-non-immediate.html:
Added.
*
LayoutTests/accessibility/search-predicate-ignored-start-relative-search-key-expected.txt:
Added.
*
LayoutTests/accessibility/search-predicate-ignored-start-relative-search-key.html:
Added.
* LayoutTests/platform/glib/TestExpectations:
* Source/WebCore/accessibility/AXCoreObject.cpp:
(WebCore::AXCoreObject::previousInPreOrder):
* Source/WebCore/accessibility/AXCoreObject.h:
* Source/WebCore/accessibility/AXSearchManager.cpp:
(WebCore::AXSearchManager::findMatchingObjectsInternalAsStream):
Canonical link: https://commits.webkit.org/315078@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
