Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7c45c234f6ac9cdb41cf2f1716fe7c4100e4cacf
https://github.com/WebKit/WebKit/commit/7c45c234f6ac9cdb41cf2f1716fe7c4100e4cacf
Author: Tyler Wilcock <[email protected]>
Date: 2026-06-16 (Tue, 16 Jun 2026)
Changed paths:
A LayoutTests/accessibility/aria-labelledby-added-via-innerHTML-expected.txt
A LayoutTests/accessibility/aria-labelledby-added-via-innerHTML.html
M Source/WebCore/accessibility/AXObjectCache.cpp
M Source/WebCore/accessibility/AXObjectCache.h
M Source/WebCore/dom/Element.cpp
Log Message:
-----------
AX: Relations are never built for elements that gain a relation attribute via
innerHTML or before having an AX object
https://bugs.webkit.org/show_bug.cgi?id=317136
rdar://179732590
Reviewed by Chris Fleizach and Dominic Mazzoni.
312262@main changed updateRelationsIfNeeded() from walking the entire DOM on
every rebuild to doing a one-time full-DOM build and thereafter re-walking
only m_elementsWithRelationAttributes. That set was populated only
from handleAttributeChange(), which is gated by shouldProcessAttributeChange()
and so requires an AX object to already exist, and from <label> insertions.
As a result, an element that acquires a relation attribute (aria-labelledby,
aria-owns, etc.) without going through handleAttributeChange() with an AX
object was never added to the set, and after the initial build its relations
were never rebuilt. This happens for:
- parser-/innerHTML-created elements
- cloneNode()
- setAttribute() on an element that has no AX object yet (the common case for
lazily/virtualized-rendered content).
Fix by tracking relation-attribute elements at Element::attributeChanged(), the
single chokepoint reached on every mutation path (parser/innerHTML, cloneNode,
and script setAttribute) regardless of whether an AX object exists yet.
* LayoutTests/accessibility/aria-labelledby-added-via-innerHTML-expected.txt:
Added.
* LayoutTests/accessibility/aria-labelledby-added-via-innerHTML.html: Added.
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::handleAttributeChange):
(WebCore::AXObjectCache::isRelationAttribute):
(WebCore::AXObjectCache::trackRelationAttributeElement):
* Source/WebCore/accessibility/AXObjectCache.h:
* Source/WebCore/dom/Element.cpp:
(WebCore::Element::attributeChanged):
Canonical link: https://commits.webkit.org/315281@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
