Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d9f55c1ea18059d105464a271fd8173f0ebcd7f2
https://github.com/WebKit/WebKit/commit/d9f55c1ea18059d105464a271fd8173f0ebcd7f2
Author: Tyler Wilcock <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
A
LayoutTests/accessibility/mac/set-selected-text-marker-range-on-non-text-element-expected.txt
A
LayoutTests/accessibility/mac/set-selected-text-marker-range-on-non-text-element.html
M Source/WebCore/accessibility/AXTextMarker.cpp
Log Message:
-----------
AX: Setting AXSelectedTextMarkerRange to an empty non-text element moves the
selection into an adjacent editable, potentially causing navigation loops
https://bugs.webkit.org/show_bug.cgi?id=320010
rdar://182947669
Reviewed by Andres Gonzalez.
When an assistive technology sets AXSelectedTextMarkerRange on the isolated
tree,
-[WebAccessibilityObjectWrapper accessibilitySetValue:forAttribute:] converts
the
incoming marker range to DOM offsets via
AXTextMarkerRange::convertToDomOffsetRange(),
which calls AXTextMarker::convertToDomOffset() on each endpoint.
For a marker anchored to a non-text object, convertToDomOffset() normalizes it
to a
text-run marker with toTextRunMarker(), which walks forward in pre-order to the
nearest
object that has text runs. For an empty non-text *leaf* (e.g. an icon button
with no
text of its own), that walk escapes the element's own subtree and lands on
unrelated
downstream text. When that text is inside an editable, applying the resulting
position
as the selection moves DOM focus into the editable.
Concretely: with "Synchronize keyboard focus and VoiceOver cursor" enabled,
moving the
VoiceOver cursor onto a hover-only button (e.g. Slack's "More actions") jumped
the cursor
and focus into the message composer, because the button's marker was walked
forward to
the composer's text on set.
Fix convertToDomOffset() to keep the marker anchored at the object itself when
the
normalized text run lies outside the object's own subtree — i.e. when the
object has no
text of its own. A non-text container that genuinely wraps descendant text is
unchanged,
since its text run is within its subtree.
*
LayoutTests/accessibility/mac/set-selected-text-marker-range-on-non-text-element-expected.txt:
Added.
*
LayoutTests/accessibility/mac/set-selected-text-marker-range-on-non-text-element.html:
Added.
* Source/WebCore/accessibility/AXTextMarker.cpp:
(WebCore::AXTextMarker::convertToDomOffset const):
Canonical link: https://commits.webkit.org/317824@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
