Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3511efda2e7d0177ba2ac2ba256c72393b61e55f
https://github.com/WebKit/WebKit/commit/3511efda2e7d0177ba2ac2ba256c72393b61e55f
Author: Zak Ridouh <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M Source/WebCore/html/FileInputType.cpp
M Source/WebCore/platform/FileChooser.h
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/UIProcess/API/APIOpenPanelParameters.h
M Source/WebKit/UIProcess/ios/WKContentViewInteraction.h
M Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
M Source/WebKit/UIProcess/ios/forms/WKFileUploadPanel.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Site Isolation] [iOS] File picker menu is anchored to the bottom of the
screen in a cross-origin iframe
https://bugs.webkit.org/show_bug.cgi?id=321139
rdar://182136484
Reviewed by Alex Christensen.
Tapping "Choose File" in a cross-origin iframe showed the source menu at the
bottom of the screen
instead of next to the button.
UIKit anchors that menu to the UITargetedPreview WKFileUploadPanel returns from
-contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:,
which the panel built
from WKContentView's _positionInformation. That is hit tested in the main
frame's process only, so
over a cross-origin iframe it found the <iframe> element and yielded no bounds.
Send the element's own rect with the open panel request instead, like the
color, datalist, date/time
and popup menus do. FileInputType::fileChooserSettings() takes it from
FrameView::convertToRootViewAcrossIsolatedFrames(), which crosses remote frame
boundaries in
process, so a site-isolated frame costs no extra IPC. showPicker() can follow a
style change with no
layout in between, so it now updates layout before reading the box.
WKFileUploadPanel anchors the menu, the highlight preview, and the keyboard
check in
-repositionContextMenuIfNeeded: to that rect. An input scrolled out of view or
positioned offscreen
to hide it behind a custom upload button has no usable box, and falls back to
the interaction
location as before. This also fixes HTMLInputElement.showPicker(), which
follows no tap and so used
a stale location.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
* Source/WebCore/html/FileInputType.cpp:
(WebCore::FileInputType::showPicker):
(WebCore::FileInputType::fileChooserSettings const):
* Source/WebCore/platform/FileChooser.h:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/UIProcess/API/APIOpenPanelParameters.h:
(API::OpenPanelParameters::elementRectInMainFrameViewCoordinates const):
* Source/WebKit/UIProcess/ios/WKContentViewInteraction.h:
* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView _createTargetedContextMenuHintPreviewForRootViewRect:]):
* Source/WebKit/UIProcess/ios/forms/WKFileUploadPanel.mm:
(-[WKFileUploadPanel presentWithParameters:resultListener:]):
(-[WKFileUploadPanel
contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]):
(-[WKFileUploadPanel repositionContextMenuIfNeeded:]):
(-[WKFileUploadPanel showDocumentPickerMenu]):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::menuAnchorRectAfterOpeningFilePicker):
(TestWebKitAPI::(SiteIsolation, FileUploadPanelAnchorRectInCrossOriginIframe)):
(TestWebKitAPI::(SiteIsolation,
FileUploadPanelAnchorRectInNestedCrossOriginIframes)):
(TestWebKitAPI::(SiteIsolation,
FileUploadPanelAnchorRectWithScrolledMainFrame)):
(TestWebKitAPI::(SiteIsolation,
FileUploadPanelAnchorRectInMainFrameIsNotOffset)):
(TestWebKitAPI::(SiteIsolation,
FileUploadPanelAnchorRectForHiddenInputInCrossOriginIframe)):
Canonical link: https://commits.webkit.org/320714@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
