Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 74c70a5bc37390b462456e98ffc3a00c6c8a172f
https://github.com/WebKit/WebKit/commit/74c70a5bc37390b462456e98ffc3a00c6c8a172f
Author: Ryosuke Niwa <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/http/tests/site-isolation/ios/long-press-selection-highlight-position-in-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/ios/long-press-selection-highlight-position-in-cross-origin-iframe.html
A
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-cross-origin-iframe.html
A
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-scrolled-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-scrolled-cross-origin-iframe.html
A
LayoutTests/http/tests/site-isolation/resources/scrollable-selectable-text-frame.html
A LayoutTests/http/tests/site-isolation/resources/selectable-text-frame.html
M Source/WebCore/accessibility/AccessibilityScrollView.cpp
M Source/WebCore/page/RemoteFrame.cpp
M Source/WebCore/page/RemoteFrame.h
M Source/WebCore/page/RemoteFrameClient.h
M Source/WebCore/page/RemoteFrameGeometryTransformer.cpp
M Source/WebCore/page/RemoteFrameView.cpp
M Source/WebKit/UIProcess/API/ios/WKWebViewTestingIOS.mm
M Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/UIProcess/WebPageProxy.swift
M Source/WebKit/UIProcess/WebPageProxyInternals.h
M Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
M Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
M Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.h
M
Source/WebKit/WebProcess/WebCoreSupport/cocoa/WebLocalFrameLoaderClientCocoa.mm
M Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Source/WebKit/WebProcess/WebPage/WebPage.h
M Source/WebKit/WebProcess/WebPage/WebPage.messages.in
M Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm
M Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm
Log Message:
-----------
[Site Isolation][iOS] Long tap does not select a word inside a cross-origin
iframe
https://bugs.webkit.org/show_bug.cgi?id=320410
Reviewed by Simon Fraser.
On iOS with site isolation enabled, text-selection gestures inside a
cross-origin iframe were broken in
several ways because the gesture machinery assumed the selection target lived
in the main frame's process:
* Long-pressing text in a cross-origin iframe selected the whole iframe
element in the parent frame
instead of a word inside it, because the gesture was never routed into the
subframe's process.
* Focus never moved into the subframe:
updateFocusBeforeSelectingTextAtLocation() used localMainFrame(),
which is null in the subframe's process.
* The selection highlight was drawn at the wrong offset, since the subframe
reports selection rects in
its own local root-view coordinates rather than offset by the iframe's
position in the top-level page.
* The highlight "flashed" at the wrong location on touch-down and only
corrected on move/up, because
UIKit reads selection rects synchronously mid-gesture, so any asynchronous
UI-process coordinate
conversion arrives too late.
* After scrolling the iframe, tapping, clicking links, and selecting all
hit-tested at the wrong location
due to double conversions of coordinates.
Fixes: route selectWithGesture and selectTextWithGranularityAtPoint into the
process containing the target
frame via RemoteUserInputEventData, fix focus to use localRootFrame(), and
convert selection rects to
main-frame coordinates in the web process (rather than the UI process) so UIKit
reads correct coordinates
synchronously. The web process obtains the frame's offset within the top-level
page through a channel
pushed from the parent process.
The scrolling bug was a double-applied scroll offset:
RemoteFrameGeometryTransformer converted a point all
the way to the remote frame's contents coordinates (via rootViewToContents()),
but every consumer delivers
the transformed point into the remote frame's process as a root-view point and
re-converts it with
rootViewToContents(), applying the remote frame's scroll offset a second time.
Transform to the remote
frame's root-view coordinates (convertFromRootView()) instead, so scroll is
applied exactly once during
hit-testing. This is the shared input transform, so it fixes tap, link
activation, and selection alike.
Also rename the offset plumbing that was reusing the accessibility offset
channel: the value it carries
(a remote frame's content origin in main-frame coordinates) is the same for
accessibility and selection,
so drop the misleading "Accessibility" qualifier and store it unconditionally
rather than only when
accessibility is active. The accessibility-specific WebCore client interface
and the Mac accessibility
element accessor keep their existing names.
* LayoutTests/TestExpectations: Skip http/tests/site-isolation/ios by default.
*
LayoutTests/http/tests/site-isolation/ios/long-press-selection-highlight-position-in-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/ios/long-press-selection-highlight-position-in-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-scrolled-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-scrolled-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/scrollable-selectable-text-frame.html:
Added.
* LayoutTests/http/tests/site-isolation/resources/selectable-text-frame.html:
Added.
* Source/WebCore/accessibility/AccessibilityScrollView.cpp: Updated for the
rename.
(WebCore::AccessibilityScrollView::addRemoteFrameChild):
* Source/WebCore/page/RemoteFrame.cpp:
(WebCore::RemoteFrame::updateRemoteFrameOffsetInMainFrame): Renamed from
(WebCore::RemoteFrame::updateRemoteFrameAccessibilityOffset): Deleted.
updateRemoteFrameAccessibilityOffset.
* Source/WebCore/page/RemoteFrame.h:
* Source/WebCore/page/RemoteFrameClient.h: Ditto.
* Source/WebCore/page/RemoteFrameGeometryTransformer.cpp:
(WebCore::RemoteFrameGeometryTransformer::transformToRemoteFrameCoordinates
const):
root-view coordinates instead of contents coordinates so the remote frame's
scroll offset is not applied twice.
* Source/WebCore/page/RemoteFrameView.cpp:
(WebCore::RemoteFrameView::setFrameRect): Push the frame's origin in main-frame
coordinates to its process.
* Source/WebKit/UIProcess/API/ios/WKWebViewTestingIOS.mm:
(-[WKWebView _selectionBoundingRectInMainFrameCoordinatesForTesting:]): Read
the rect directly.
* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:
(WebKit::WebPageProxy::selectWithGesture):
(WebKit::WebPageProxy::selectTextWithGranularityAtPoint): Re-dispatch into the
remote frame, reporting
the gesture point in content-view coordinates.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::updateRemoteFrameOffsetInMainFrame): Renamed.
(WebKit::WebPageProxy::pushCumulativeOffsetInMainFrame):
(WebKit::WebPageProxy::updateRemoteFrameAccessibilityOffset): Deleted.
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in: Renamed message; added
frame-routed selection.
* Source/WebKit/UIProcess/WebPageProxy.swift: Updated selection callers.
* Source/WebKit/UIProcess/WebPageProxyInternals.h:
* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm: Pass the target
frame identifier; read converted
(-[WKContentView lookupForWebView:]):
(-[WKContentView shareForWebView:]):
(-[WKContentView translateForWebView:]):
(-[WKContentView addShortcutForWebView:]):
(-[WKContentView
changeSelectionWithGestureAt:withGesture:withState:withFlags:]):
(-[WKContentView selectTextWithGranularity:atPoint:completionHandler:]):
rects from the editor state directly at the menu callsites.
* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm: Removed the UI-process
selection-rect conversion path in
(WebKit::WebPageProxy::didUpdateEditorState):
(WebKit::WebPageProxy::convertEditorStateSelectionRectToMainFrameCoordinates):
Deleted.
favor of web-process conversion.
* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp:
(WebKit::WebRemoteFrameClient::updateRemoteFrameOffsetInMainFrame): Renamed.
(WebKit::WebRemoteFrameClient::updateRemoteFrameAccessibilityOffset): Deleted.
* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.h:
*
Source/WebKit/WebProcess/WebCoreSupport/cocoa/WebLocalFrameLoaderClientCocoa.mm:
(WebKit::WebLocalFrameLoaderClient::accessibilityRemoteFrameOffset): Call the
renamed WebPage getter.
* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:
(WebKit::remoteUserInputEventDataForSelectionGesture):
(WebKit::WebPage::selectWithGesture):
(WebKit::WebPage::updateFocusBeforeSelectingTextAtLocation):
(WebKit::WebPage::selectPositionAtPoint):
(WebKit::WebPage::setSelectionRange): Use localRootFrame(frameID).
(WebKit::WebPage::selectTextWithGranularityAtPoint): Re-route to the remote
subframe.
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updateRemotePageOffsetInMainFrame): Renamed from
(WebKit::WebPage::updateRemotePageAccessibilityOffset): Deleted.
updateRemotePageAccessibilityOffset.
* Source/WebKit/WebProcess/WebPage/WebPage.h:
* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:
* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::getPlatformEditorState const):
(WebKit::WebPage::updateRemotePageOffsetInMainFrame):
(WebKit::WebPage::remoteFrameOffsetInMainFrame): Renamed; store the offset
unconditionally.
(WebKit::WebPage::updateRemotePageAccessibilityOffset): Deleted.
(WebKit::WebPage::accessibilityRemoteFrameOffset): Deleted.
* Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::updateRemotePageOffsetInMainFrame):
(WebKit::WebPage::remoteFrameOffsetInMainFrame): Renamed.
(WebKit::WebPage::updateRemotePageAccessibilityOffset): Deleted.
(WebKit::WebPage::accessibilityRemoteFrameOffset): Deleted.
Canonical link: https://commits.webkit.org/318296@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
