/*

* Copyright (C) 2008-2025 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

*

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

* 3. Neither the name of Apple Inc. ("Apple") nor the names of

* its contributors may be used to endorse or promote products derived

* from this software without specific prior written permission.

*

* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY

* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "AccessibilityObject.h"

#include "AccessibilityNodeObjectInlines.h"

#include "AXAttributeCacheScope.h"

#include "AXChildIterator.h"

#include "AXComputedObjectAttributeCache.h"

#include "AXIsolatedTree.h"

#include "AXLogger.h"

#include "AXLoggerBase.h"

#include "AXNotifications.h"

#include "AXObjectCacheInlines.h"

#include "AXObjectRareData.h"

#include "AXRemoteFrame.h"

#include "AXTextMarker.h"

#include "AXUtilities.h"

#include "AccessibilityMockObject.h"

#include "AccessibilityObjectInlines.h"

#include "AccessibilityRenderObject.h"

#include "AccessibilityScrollView.h"

#include "CachedImage.h"

#include "Chrome.h"

#include "ChromeClient.h"

#include "ContainerNodeInlines.h"

#include "ContextMenuController.h"

#include "CustomElementDefaultARIA.h"

#include "DOMTokenList.h"

#include "DocumentPage.h"

#include "DocumentView.h"

#include "EditingInlines.h"

#include "Editor.h"

#include "ElementInlines.h"

#include "ElementIterator.h"

#include "Event.h"

#include "EventDispatcher.h"

#include "EventHandler.h"

#include "EventNames.h"

#include "FloatRect.h"

#include "FocusController.h"

#include "FrameLoader.h"

#include "FrameSelection.h"

#include "GeometryUtilities.h"

#include "HTMLAreaElement.h"

#include "HTMLBRElement.h"

#include "HTMLBodyElement.h"

#include "HTMLDataListElement.h"

#include "HTMLDetailsElement.h"

#include "HTMLFormControlElement.h"

#include "HTMLHeadingElement.h"

#include "HTMLInputElement.h"

#include "HTMLModelElement.h"

#include "HTMLNames.h"

#include "HTMLOptionElement.h"

#include "HTMLParserIdioms.h"

#include "HTMLSelectElement.h"

#include "HTMLSlotElement.h"

#include "HTMLTableSectionElement.h"

#include "HTMLTextAreaElement.h"

#include "HitTestResult.h"

#include "Image.h"

#include "ImageBuffer.h"

#include "LocalFrame.h"

#include "LocalizedStrings.h"

#include "Logging.h"

#include "MathMLNames.h"

#include "NodeList.h"

#include "NodeName.h"

#include "NodeTraversal.h"

#include "Page.h"

#include "PixelBuffer.h"

#include "PositionInlines.h"

#include "ProgressTracker.h"

#include "Range.h"

#include "RemoteFrame.h"

#include "RenderBlockFlow.h"

#include "RenderDescendantIterator.h"

#include "RenderElementInlines.h"

#include "RenderImage.h"

#include "RenderImageResource.h"

#include "RenderLayer.h"

#include "RenderLayerInlines.h"

#include "RenderListItem.h"

#include "RenderListOutsideMarker.h"

#include "RenderObjectInlines.h"

#include "RenderText.h"

#include "RenderTextControl.h"

#include "RenderTheme.h"

#include "RenderView.h"

#include "RenderWidget.h"

#include "RenderedPosition.h"

#include "SVGNames.h"

#include "Settings.h"

#include "SharedBuffer.h"

#include "SimulatedClick.h"

#include "TextCheckerClient.h"

#include "TextCheckingHelper.h"

#include "TextControlInnerElements.h"

#include "TextIterator.h"

#include "UserGestureIndicator.h"

#include "VisibleUnits.h"

#include <numeric>

#include <ranges>

#include <wtf/NeverDestroyed.h>

#include <wtf/StdLibExtras.h>

#include <wtf/text/MakeString.h>

#include <wtf/text/StringBuilder.h>

#include <wtf/text/StringView.h>

#include <wtf/text/WTFString.h>

#include <wtf/unicode/CharacterNames.h>

#if ENABLE(MODEL_ELEMENT_ACCESSIBILITY)

#include "ModelPlayerAccessibilityChildren.h"

#endif

namespace WebCore {

using namespace HTMLNames;

AccessibilityObject::AccessibilityObject(AXID axID, AXObjectCache& cache)

: AXCoreObject(axID)

, m_axObjectCache(cache)

{

}

AccessibilityObject::~AccessibilityObject()

{

AX_ASSERT(isDetached());

if (CheckedPtr cache = axObjectCache()) {

if (cache->isCounted(*this))

cache->uncount(*this);

}

}

String AccessibilityObject::debugDescriptionInternal(bool verbose, std::optional<OptionSet<AXDebugStringOption>> debugOptions) const

{

StringBuilder result;

result.append("{"_s);

result.append("role: "_s, roleToString(role()));

result.append(", ID "_s, objectID().loggingString());

if (debugOptions) {

if (verbose || *debugOptions & AXDebugStringOption::Ignored)

result.append(isIgnored() ? ", ignored"_s : emptyString());

if (verbose || *debugOptions & AXDebugStringOption::RelativeFrame) {

FloatRect frame = relativeFrame();

result.append(", relativeFrame ((x: "_s, frame.x(), ", y: "_s, frame.y(), "), (w: "_s, frame.width(), ", h: "_s, frame.height(), "))"_s);

}

if (verbose || *debugOptions & AXDebugStringOption::RemoteFrameOffset)

result.append(", remoteFrameOffset ("_s, remoteFrameOffset().x(), ", "_s, remoteFrameOffset().y(), ")"_s);

if (verbose || *debugOptions & AXDebugStringOption::IsRemoteFrame)

result.append(isRemoteFrame() ? ", remote frame"_s : emptyString());

}

if (auto* renderer = this->renderer())

result.append(", "_s, renderer->debugDescription());

else if (auto* node = this->node())

result.append(", "_s, node->debugDescription());

if (String extraDebugInfo = this->extraDebugInfo(); !extraDebugInfo.isEmpty()) {

result.append(" ("_s);

result.append(WTF::move(extraDebugInfo));

result.append(")"_s);

}

result.append("}"_s);

return result.toString();

}

void AccessibilityObject::postMenuClosedNotificationIfNecessary() const

{

if (!isMenu())

return;

if (CheckedPtr cache = axObjectCache()) {

// Assistive technologies need to be informed when menus close.

// No element is passed in the notification because it's a destruction event.

cache->postNotification(nullptr, protect(cache->document()), AXNotification::MenuClosed);

}

}

void AccessibilityObject::detachRemoteParts(AccessibilityDetachmentType detachmentType)

{

if (detachmentType == AccessibilityDetachmentType::ElementDestroyed)

postMenuClosedNotificationIfNecessary();

// Clear any children and call detachFromParent on them so that

// no children are left with dangling pointers to their parent.

clearChildren();

}

OptionSet<AXAncestorFlag> AccessibilityObject::computeAncestorFlags() const

{

OptionSet<AXAncestorFlag> computedFlags;

if (hasAncestorFlag(AXAncestorFlag::IsInDescriptionListDetail) || matchesAncestorFlag(AXAncestorFlag::IsInDescriptionListDetail))

computedFlags.set(AXAncestorFlag::IsInDescriptionListDetail, 1);

if (hasAncestorFlag(AXAncestorFlag::IsInDescriptionListTerm) || matchesAncestorFlag(AXAncestorFlag::IsInDescriptionListTerm))

computedFlags.set(AXAncestorFlag::IsInDescriptionListTerm, 1);

if (hasAncestorFlag(AXAncestorFlag::IsInCell) || matchesAncestorFlag(AXAncestorFlag::IsInCell))

computedFlags.set(AXAncestorFlag::IsInCell, 1);

if (hasAncestorFlag(AXAncestorFlag::IsInRow) || matchesAncestorFlag(AXAncestorFlag::IsInRow))

computedFlags.set(AXAncestorFlag::IsInRow, 1);

return computedFlags;

}

OptionSet<AXAncestorFlag> AccessibilityObject::computeAncestorFlagsWithTraversal() const

{

// If this object's flags are initialized, this traversal is unnecessary. Use AccessibilityObject::ancestorFlags() instead.

AX_ASSERT(!ancestorFlagsAreInitialized());

OptionSet<AXAncestorFlag> computedFlags;

computedFlags.set(AXAncestorFlag::FlagsInitialized, true);

Accessibility::enumerateAncestors<AccessibilityObject>(*this, false, [&] (const AccessibilityObject& ancestor) {

computedFlags.add(ancestor.computeAncestorFlags());

});

return computedFlags;

}

bool AccessibilityObject::matchesAncestorFlag(AXAncestorFlag flag) const

{

auto role = this->role();

switch (flag) {

case AXAncestorFlag::IsInDescriptionListDetail:

return role == AccessibilityRole::DescriptionListDetail;

case AXAncestorFlag::IsInDescriptionListTerm:

return role == AccessibilityRole::DescriptionListTerm;

case AXAncestorFlag::IsInCell:

return role == AccessibilityRole::Cell;

case AXAncestorFlag::IsInRow:

return role == AccessibilityRole::Row;

default:

AX_ASSERT_NOT_REACHED();

return false;

}

}

bool AccessibilityObject::hasAncestorMatchingFlag(AXAncestorFlag flag) const

{

return Accessibility::findAncestor<AccessibilityObject>(*this, false, [flag] (const AccessibilityObject& object) {

if (object.ancestorFlagsAreInitialized())

return object.ancestorFlags().contains(flag);

return object.matchesAncestorFlag(flag);

}) != nullptr;

}

bool AccessibilityObject::isInDescriptionListDetail() const

{

if (ancestorFlagsAreInitialized())

return m_ancestorFlags.contains(AXAncestorFlag::IsInDescriptionListDetail);

return hasAncestorMatchingFlag(AXAncestorFlag::IsInDescriptionListDetail);

}

bool AccessibilityObject::isInDescriptionListTerm() const

{

if (ancestorFlagsAreInitialized())

return m_ancestorFlags.contains(AXAncestorFlag::IsInDescriptionListTerm);

return hasAncestorMatchingFlag(AXAncestorFlag::IsInDescriptionListTerm);

}

bool AccessibilityObject::isInCell() const

{

if (ancestorFlagsAreInitialized())

return m_ancestorFlags.contains(AXAncestorFlag::IsInCell);

return hasAncestorMatchingFlag(AXAncestorFlag::IsInCell);

}

bool AccessibilityObject::isInRow() const

{

if (ancestorFlagsAreInitialized())

return m_ancestorFlags.contains(AXAncestorFlag::IsInRow);

return hasAncestorMatchingFlag(AXAncestorFlag::IsInRow);

}

// ARIA marks elements as having their accessible name derive from either their contents, or their author-provided name.

bool AccessibilityObject::accessibleNameDerivesFromContent() const

{

// First check for objects specifically identified by ARIA.

switch (ariaRoleAttribute()) {

case AccessibilityRole::ApplicationAlert:

case AccessibilityRole::ApplicationAlertDialog:

case AccessibilityRole::ApplicationDialog:

case AccessibilityRole::ApplicationLog:

case AccessibilityRole::ApplicationMarquee:

case AccessibilityRole::ApplicationStatus:

case AccessibilityRole::ApplicationTimer:

case AccessibilityRole::ComboBox:

case AccessibilityRole::Definition:

case AccessibilityRole::Document:

case AccessibilityRole::DocumentArticle:

case AccessibilityRole::DocumentMath:

case AccessibilityRole::DocumentNote:

case AccessibilityRole::LandmarkRegion:

case AccessibilityRole::LandmarkDocRegion:

case AccessibilityRole::Form:

case AccessibilityRole::Grid:

case AccessibilityRole::Group:

case AccessibilityRole::Image:

case AccessibilityRole::List:

case AccessibilityRole::ListBox:

case AccessibilityRole::LandmarkBanner:

case AccessibilityRole::LandmarkComplementary:

case AccessibilityRole::LandmarkContentInfo:

case AccessibilityRole::LandmarkNavigation:

case AccessibilityRole::LandmarkMain:

case AccessibilityRole::LandmarkSearch:

case AccessibilityRole::Menu:

case AccessibilityRole::MenuBar:

case AccessibilityRole::ProgressIndicator:

case AccessibilityRole::Meter:

case AccessibilityRole::RadioGroup:

case AccessibilityRole::SectionFooter:

case AccessibilityRole::SectionHeader:

case AccessibilityRole::ScrollBar:

case AccessibilityRole::Slider:

case AccessibilityRole::SpinButton:

case AccessibilityRole::Splitter:

case AccessibilityRole::Table:

case AccessibilityRole::TabList:

case AccessibilityRole::TabPanel:

case AccessibilityRole::TextArea:

case AccessibilityRole::TextField:

case AccessibilityRole::Toolbar:

case AccessibilityRole::TreeGrid:

case AccessibilityRole::Tree:

case AccessibilityRole::WebApplication:

return false;

default:

break;

}

// Now check for generically derived elements now that we know the element does not match a specific ARIA role.

switch (role()) {

case AccessibilityRole::Slider:

case AccessibilityRole::ListBox:

return false;

default:

break;

}

return true;

}

String AccessibilityObject::computedLabel()

{

// This method is being called by WebKit inspector, which may happen at any time, so we need to update our backing store now.

// Also hold onto this object in case updateBackingStore deletes this node.

Ref protectedThis { *this };

updateBackingStore();

Vector<AccessibilityText> text;

accessibilityText(text);

if (text.size())

return text[0].text;

return { };

}

// FIXME: We should unify all of the special cases for live regions, textUnderElement, title, description, etc. under one method, similar to computedLabel.

String AccessibilityObject::announcementText() const

{

Vector<AccessibilityText> computedText;

accessibilityText(computedText);

#if PLATFORM(COCOA)

String descriptionText = descriptionAttributeValue(&computedText);

if (!descriptionText.isEmpty())

return descriptionText;

#endif

if (is<HTMLInputElement>(node())) {

// Many inputs derive their accessible name from their title.

if (String titleText = title(&computedText); !titleText.isEmpty())

return titleText;

}

TextUnderElementMode mode;

mode.includeListMarkers = IncludeListMarkerText::Yes;

// We want all of the text beneath this object when speaking live regions.

mode.descendIntoContainers = DescendIntoContainers::Yes;

mode.childrenInclusion = TextUnderElementMode::Children::IncludeNameFromContentsChildren;

return textUnderElement(mode);

}

bool AccessibilityObject::isEditableWebArea() const

{

if (!isWebArea())

return false;

RefPtr page = this->page();

if (page && page->isEditable())

return true;

RefPtr document = this->document();

return document && document->inDesignMode();

}

Vector<AXTextMarkerRange> AccessibilityObject::misspellingRanges() const

{

AXTRACE("AccessibilityObject::misspellingRanges"_s);

RefPtr node = this->node();

if (!node)

return { };

RefPtr frame = protect(node->document())->frame();

if (!frame)

return { };

Ref editor = frame->editor();

auto* textChecker = editor->textChecker();

if (!textChecker)

return { };

// In order to resolve to the correct ranges, Editor::rangeForTextCheckingResult(...)

// assumes that the selection is within the Node for which text we are calling checkTextOfParagraph.

// Therefore, remember the current selection, set it to the beginning of the Node and restore it aftwards.

auto originalSelection = frame->selection().selection();

if (auto range = simpleRange()) {

// Passing UserTriggered::No, which is the default value, guaranties that accessibility is not notified of text selection changes.

protect(frame->selection())->setSelectedRange(SimpleRange { range->start, range->start }, Affinity::Downstream, FrameSelection::ShouldCloseTyping::Yes, UserTriggered::No);

}

Vector<AXTextMarkerRange> ranges;

if (unifiedTextCheckerEnabled(frame.get())) {

Vector<TextCheckingResult> misspellings;

checkTextOfParagraph(*textChecker, stringValue(), TextCheckingType::Spelling, misspellings, frame->selection().selection());

for (auto& misspelling : misspellings) {

if (auto range = editor->rangeForTextCheckingResult(misspelling))

ranges.append(range);

}

} else {

int location = -1;

int length = 0;

textChecker->checkSpellingOfString(stringValue(), &location, &length);

if (location > -1 && length > 0)

ranges = { { treeID(), objectID(), static_cast<unsigned>(location), static_cast<unsigned>(length) } };

}

protect(frame->selection())->setSelectedRange(originalSelection.range(), Affinity::Downstream, FrameSelection::ShouldCloseTyping::Yes, UserTriggered::No);

return ranges;

}

std::optional<SimpleRange> AccessibilityObject::misspellingRange(const SimpleRange& start, AccessibilitySearchDirection direction) const

{

auto node = this->node();

if (!node)

return std::nullopt;

RefPtr frame = protect(node->document())->frame();

if (!frame)

return std::nullopt;

if (!unifiedTextCheckerEnabled(frame.get()))

return std::nullopt;

Ref editor = frame->editor();

TextCheckerClient* textChecker = editor->textChecker();

if (!textChecker)

return std::nullopt;

Vector<TextCheckingResult> misspellings;

checkTextOfParagraph(*textChecker, stringValue(), TextCheckingType::Spelling, misspellings, frame->selection().selection());

// Find the first misspelling past the start.

if (direction == AccessibilitySearchDirection::Next) {

for (auto& misspelling : misspellings) {

auto misspellingRange = editor->rangeForTextCheckingResult(misspelling);

if (misspellingRange && is_gt(treeOrder<ComposedTree>(misspellingRange->end, start.end)))

return *misspellingRange;

}

} else {

for (auto& misspelling : misspellings | std::views::reverse) {

auto misspellingRange = editor->rangeForTextCheckingResult(misspelling);

if (misspellingRange && is_lt(treeOrder<ComposedTree>(misspellingRange->start, start.start)))

return *misspellingRange;

}

}

return std::nullopt;

}

AXTextMarkerRange AccessibilityObject::textInputMarkedTextMarkerRange() const

{

WeakPtr node = this->node();

if (!node)

return { };

RefPtr frame = protect(node->document())->frame();

if (!frame)

return { };

CheckedPtr cache = axObjectCache();

if (!cache)

return { };

Ref editor = frame->editor();

RefPtr object = cache->getOrCreate(protect(editor->compositionNode()));

if (!object)

return { };

if (RefPtr observableObject = object->observableObject())

object = observableObject;

if (object->objectID() != objectID())

return { };

return { editor->compositionRange() };

}

AccessibilityObject* AccessibilityObject::displayContentsParent() const

{

RefPtr parentNode = node() ? node()->parentNode() : nullptr;

if (RefPtr parentElement = dynamicDowncast<Element>(parentNode); !parentElement || !parentElement->hasDisplayContents())

return nullptr;

CheckedPtr cache = axObjectCache();

return cache ? cache->getOrCreate(*parentNode) : nullptr;

}

AccessibilityObject::iterator::iterator(const AccessibilityObject* object, const AccessibilityObject* displayContentsParent)

: m_current(object)

, m_displayContentsParent(displayContentsParent)

{

RefPtr parentNode = displayContentsParent ? dynamicDowncast<ContainerNode>(displayContentsParent->node()) : nullptr;

RefPtr node = object ? object->node() : nullptr;

if (!parentNode || !node || composedParentIgnoringDocumentFragments(*node) != parentNode)

return;

auto children = composedTreeChildren</* InlineContextCapacity */ 0>(*parentNode);

auto child = children.at(*node);

auto end = children.end();

if (child != end)

m_composedTreeChildren = ComposedTreeChildren { WTF::move(child), WTF::move(end) };

}

RefPtr<AccessibilityObject> AccessibilityObject::iterator::nextSiblingInComposedTree()

{

if (!m_composedTreeChildren)

return nullptr;

CheckedPtr cache = protect(m_displayContentsParent)->axObjectCache();

if (!cache)

return nullptr;

auto& [child, end] = *m_composedTreeChildren;

for (++child; child != end; ++child) {

Ref node = *child;

if (RefPtr object = cache->getOrCreate(node.get()))

return object;

}

return nullptr;

}

RefPtr<AccessibilityObject> AccessibilityObject::iterator::previousSiblingInComposedTree()

{

if (!m_composedTreeChildren)

return nullptr;

CheckedPtr cache = protect(m_displayContentsParent)->axObjectCache();

if (!cache)

return nullptr;

auto& [child, end] = *m_composedTreeChildren;

for (--child; child != end; --child) {

Ref node = *child;

if (RefPtr object = cache->getOrCreate(node.get()))

return object;

}

return nullptr;

}

AccessibilityObject* AccessibilityObject::nextSiblingUnignored(unsigned limit) const

{

AX_ASSERT(limit);

for (auto sibling = iterator(protect(nextSibling())); limit && sibling; --limit, ++sibling) {

if (!protect(*sibling)->isIgnored())

return sibling.ptr();

}

return nullptr;

}

AccessibilityObject* AccessibilityObject::previousSiblingUnignored(unsigned limit) const

{

AX_ASSERT(limit);

for (auto sibling = iterator(protect(previousSibling())); limit && sibling; --limit, --sibling) {

if (!protect(*sibling)->isIgnored())

return sibling.ptr();

}

return nullptr;

}

FloatRect AccessibilityObject::convertFrameToSpace(const FloatRect& frameRect, AccessibilityConversionSpace conversionSpace) const

{

AX_ASSERT(isMainThread());

// Find the appropriate scroll view to use to convert the contents to the window.

RefPtr parentAccessibilityScrollView = ancestorAccessibilityScrollView(false /* includeSelf */);

RefPtr parentScrollView = parentAccessibilityScrollView ? parentAccessibilityScrollView->scrollView() : nullptr;

auto snappedFrameRect = snappedIntRect(IntRect(frameRect));

#if ENABLE(ACCESSIBILITY_LOCAL_FRAME)

if (conversionSpace == AccessibilityConversionSpace::Screen) {

// screenPosition is content-origin-based (shifts with scroll). Element rects are in content

// space (no scroll applied). These compose directly to give correct screen coordinates.

RefPtr rootScrollView = dynamicDowncast<AccessibilityScrollView>(ancestorAccessibilityScrollView(true /* includeSelf */));

if (!rootScrollView)

return snappedFrameRect;

auto geometry = rootScrollView->frameGeometry();

// The top-level page scroll view's own frame is in view/device space (the viewport). Every other

// object's frame is content-space. screenTransform is the content->screen page-zoom scale, so

// applying it to the already-device-space viewport double-scales it (viewport * pageZoom),

// shrinking the frame that Voice Control, Switch Control, etc. clips its set of visible elements

// against. Skip the transform for the top page scroll view's own frame only.

//

// Guard on "no ancestor scroll view" -- NOT isRoot(), which is also true for local iframe roots under

// ACCESSIBILITY_LOCAL_FRAME -- so iframe scroll views (content-space elementRect) are still scaled.

// No-op at page zoom 1.0 (screenTransform is identity).

const bool isTopPageScrollViewOwnFrame = this == rootScrollView.get() && !parentAccessibilityScrollView;

auto scaledRect = isTopPageScrollViewOwnFrame

? FloatRect(snappedFrameRect)

: geometry.screenTransform.mapRect(FloatRect(snappedFrameRect));

auto screenPosition = geometry.screenPosition;

IntPoint currentScrollOffset;

if (RefPtr scrollView = rootScrollView->scrollView())

currentScrollOffset = scrollView->documentScrollPositionRelativeToViewOrigin();

auto currentScroll = geometry.screenTransform.mapPoint(FloatPoint(currentScrollOffset));

// This was the scroll at the time |geometry.screenPosition| was taken. The scroll

// may have changed since then, and we may not have gotten the corresponding AXFrameGeometry

// update yet. We can avoid serving stale geometry in this scenario by taking |cachedScroll|

// and undo'ing it from the screen position, and then applying the current-scroll offset (which we

// can do in this context, being on the main-thread). This prevents ATs from temporarily reading

// a stale value.

auto cachedScroll = geometry.screenTransform.mapPoint(FloatPoint(rootScrollView->frameViewOriginScrollPosition()));

// macOS uses bottom-left origin, non-macOS assumes top-left origin.

// FIXME: It would be cleaner to store screenPosition as one canonical value

// and apply the Mac transformations only as a final step.

#if PLATFORM(MAC)

// accessibility/mac/webkit-scrollarea-position.html demands that we don't

// apply the current scroll for the root.

const bool applyCurrentScroll = this != rootScrollView.get();

constexpr int yScale = -1;

#else

const bool applyCurrentScroll = true;

constexpr int yScale = 1;

#endif

FloatPoint scrollDelta = cachedScroll;

if (applyCurrentScroll)

scrollDelta.move(-currentScroll.x(), -currentScroll.y());

screenPosition.move(roundToInt(scrollDelta.x()), yScale * roundToInt(scrollDelta.y()));

FloatPoint position = {

screenPosition.x() + scaledRect.x(),

#if PLATFORM(MAC)

screenPosition.y() - scaledRect.maxY()

#else

screenPosition.y() + scaledRect.y()

#endif

};

return { position, scaledRect.size() };

}

// For page space geometry (somewhat deprecated with ENABLE_ACCESSIBILITY_LOCAL_FRAME), return element rects in content space (no scroll applied).

return snappedFrameRect;

#else

// Legacy behavior: contentsToRootView walks up through all frames for local frames.

// For remote frames, the caller (e.g., relativeFrame()) adds remoteFrameOffset().

if (parentScrollView)

snappedFrameRect = parentScrollView->contentsToRootView(snappedFrameRect);

if (conversionSpace == AccessibilityConversionSpace::Screen) {

RefPtr page = this->page();

if (!page)

return snappedFrameRect;

// If we have an empty chrome client (like SVG) then we should use the page

// of the scroll view parent to help us get to the screen rect.

if (parentAccessibilityScrollView && page->chrome().client().isEmptyChromeClient())

page = parentAccessibilityScrollView->page();

snappedFrameRect = page->chrome().rootViewToAccessibilityScreen(snappedFrameRect);

}

#endif // ENABLE(ACCESSIBILITY_LOCAL_FRAME)

return snappedFrameRect;

}

FloatRect AccessibilityObject::relativeFrame() const

{

auto rect = elementRect();

#if !ENABLE(ACCESSIBILITY_LOCAL_FRAME)

rect.moveBy(remoteFrameOffset());

#endif

return convertFrameToSpace(rect, AccessibilityConversionSpace::Page);

}

AccessibilityObject* AccessibilityObject::firstAccessibleObjectFromNode(const Node* node)

{

return WebCore::firstAccessibleObjectFromNode(node, [] (const AccessibilityObject& accessible) {

return !accessible.isIgnored();

});

}

AccessibilityObject* firstAccessibleObjectFromNode(const Node* node, NOESCAPE const Function<bool(const AccessibilityObject&)>& isAccessible)

{

RefPtr axNode = node;

if (!axNode)

return nullptr;

CheckedPtr cache = protect(axNode->document())->axObjectCache();

if (!cache)

return nullptr;

RefPtr accessibleObject = cache->getOrCreate(const_cast<Node&>(*axNode));

while (accessibleObject && !isAccessible(*accessibleObject)) {

axNode = NodeTraversal::next(*axNode);

while (axNode && !axNode->renderer())

axNode = NodeTraversal::nextSkippingChildren(*axNode);

if (!axNode)

return nullptr;

accessibleObject = cache->getOrCreate(const_cast<Node&>(*axNode));

}

return accessibleObject.unsafeGet();

}

// FIXME: Usages of this function should be replaced by a new flag in AccessibilityObject::m_ancestorFlags.

bool AccessibilityObject::isDescendantOfRole(AccessibilityRole role) const

{

return Accessibility::findAncestor<AccessibilityObject>(*this, false, [&role] (const AccessibilityObject& object) {

return object.role() == role;

}) != nullptr;

}

static bool isTableComponent(AXCoreObject& axObject)

{

return axObject.isTable() || axObject.isTableColumn() || axObject.isExposedTableRow() || axObject.isTableCell();

}

void AccessibilityObject::insertChild(AccessibilityObject& child, unsigned index, DescendIfIgnored descendIfIgnored)

{

if (child.anyObjectHasAriaOwns()) {

auto owners = child.owners();

if (owners.size()) {

size_t indexOfThis = owners.findIf([this] (const Ref<AXCoreObject>& object) {

return object.ptr() == this;

});

if (indexOfThis == notFound) {

// The child is aria-owned, and not by us, so we shouldn't insert it.

return;

}

}

}

if (is<HTMLAreaElement>(child.node())) [[unlikely]] {

// Despite the DOM parent for <area> elements being <map>, we expose <area> elements as children

// of the <img> using the <map>. This provides a better experience for AT users, e.g. a screenreader

// would hear "image map" or "group" plus the image description, then the links, which provides the

// added context for what the links represent.

//

// Due to the difference in DOM vs. expected AX hierarchy, make sure area elements are only inserted

// by their associated image as children.

if (child.parentObject() != this)

return;

}

// If the parent is asking for this child's children, then either it's the first time (and clearing is a no-op),

// or its visibility has changed. In the latter case, this child may have a stale child cached.

// This can prevent aria-hidden changes from working correctly. Hence, whenever a parent is getting children, ensure data is not stale.

// Only clear the child's children when we know it's in the updating chain in order to avoid unnecessary work.

if (child.needsToUpdateChildren() || m_subtreeDirty) {

child.clearChildren();

// Pass m_subtreeDirty flag down to the child so that children cache gets reset properly.

if (m_subtreeDirty)

child.setNeedsToUpdateSubtree();

}

#if USE(ATSPI)

// FIXME: Consider removing this ATSPI-only branch with https://bugs.webkit.org/show_bug.cgi?id=282117.

RefPtr displayContentsParent = child.displayContentsParent();

// To avoid double-inserting a child of a `display: contents` element, only insert if `this` is the rightful parent.

if (displayContentsParent && displayContentsParent != this) {

// Make sure the display:contents parent object knows it has a child it needs to add.

displayContentsParent->setNeedsToUpdateChildren();

// Don't exit early for certain table components, as they rely on inserting children for which they are not the rightful parent to behave correctly.

bool allowInsert = isTableColumn() || role() == AccessibilityRole::TableHeaderContainer;

// AccessibilityTable::addChildren never actually calls `insertChild` for table section elements

// (e.g. tbody, thead), so don't block this `insertChild` for display:contents section elements,

// or else the child elements of the section element will never be inserted into the tree.

allowInsert = allowInsert || (isTable() && is<HTMLTableSectionElement>(displayContentsParent->element()));

if (!allowInsert)

return;

}

#endif // USE(ATSPI)

auto insert = [this] (Ref<AXCoreObject>&& object, unsigned index) {

std::ignore = setChildIndexInParent(object.get(), index);

m_children.insert(index, WTF::move(object));

// Update child-index for children after the newly inserted object.

for (unsigned i = index + 1; i < m_children.size(); i++)

std::ignore = setChildIndexInParent(m_children[i].get(), i);

};

auto thisAncestorFlags = computeAncestorFlags();

child.initializeAncestorFlags(thisAncestorFlags);

setIsIgnoredFromParentDataForChild(child);

if (!includeIgnoredInCoreTree() && child.isIgnored()) {

if (descendIfIgnored == DescendIfIgnored::Yes) {

unsigned insertionIndex = index;

auto childAncestorFlags = child.computeAncestorFlags();

for (auto grandchildCoreObject : child.children()) {

Ref grandchild = downcast<AccessibilityObject>(grandchildCoreObject.get());

// Even though `child` is ignored, we still need to set ancestry flags based on it.

grandchild->initializeAncestorFlags(childAncestorFlags);

grandchild->addAncestorFlags(thisAncestorFlags);

// Calls to `child.isIgnored()` or `child.children()` can cause layout, which in turn can cause this object to clear its m_children. This can cause `insertionIndex` to no longer be valid. Detect this and break early if necessary.

if (insertionIndex > m_children.size())

break;

insert(WTF::move(grandchild), insertionIndex);

++insertionIndex;

}

}

} else {

// Table component child-parent relationships often don't line up properly, hence the need for methods

// like parentTable() and parentRow(). Exclude them from this ASSERT.

// FIXME: We hit this ASSERT on gmail.com. https://bugs.webkit.org/show_bug.cgi?id=293264

AX_BROKEN_ASSERT(isTableComponent(child) || isTableComponent(*this) || child.parentObject() == this);

insert(Ref { child }, index);

}

// Reset the child's m_isIgnoredFromParentData since we are done adding that child and its children.

child.clearIsIgnoredFromParentData();

}

void AccessibilityObject::resetChildrenIndexInParent() const

{

if (!shouldSetChildIndexInParent())

return;

unsigned index = 0;

for (const auto& child : m_children) {

bool didSet = setChildIndexInParent(child.get(), index);

// We check shouldSetChildIndexInParent above, so this should always be true.

ASSERT_UNUSED(didSet, didSet);

++index;

}

}

AXCoreObject::AccessibilityChildrenVector AccessibilityObject::findMatchingObjectsWithin(AccessibilitySearchCriteria&& criteria)

{

if (CheckedPtr cache = axObjectCache())

cache->startCachingComputedObjectAttributesUntilTreeMutates();

return AXCoreObject::findMatchingObjectsWithin(WTF::move(criteria));

}

// Returns the range that is fewer positions away from the reference range.

// NOTE: The after range is expected to ACTUALLY be after the reference range and the before

// range is expected to ACTUALLY be before. These are not checked for performance reasons.

static std::optional<SimpleRange> rangeClosestToRange(const SimpleRange& referenceRange, std::optional<SimpleRange>&& afterRange, std::optional<SimpleRange>&& beforeRange)

{

if (!beforeRange)

return WTF::move(afterRange);

if (!afterRange)

return WTF::move(beforeRange);

auto distanceBefore = characterCount({ beforeRange->end, referenceRange.start });

auto distanceAfter = characterCount({ afterRange->start, referenceRange.end });

return WTF::move(distanceBefore <= distanceAfter ? beforeRange : afterRange);

}

std::optional<SimpleRange> AccessibilityObject::rangeOfStringClosestToRangeInDirection(const SimpleRange& referenceRange, AccessibilitySearchDirection searchDirection, const Vector<String>& searchStrings) const

{

RefPtr frame = this->frame();

if (!frame)

return std::nullopt;

bool isBackwardSearch = searchDirection == AccessibilitySearchDirection::Previous;

FindOptions findOptions { FindOption::AtWordStarts, FindOption::AtWordEnds, FindOption::CaseInsensitive, FindOption::StartInSelection };

if (isBackwardSearch)

findOptions.add(FindOption::Backwards);

std::optional<SimpleRange> closestStringRange;

for (auto& searchString : searchStrings) {

if (std::optional foundStringRange = protect(frame->editor())->rangeOfString(searchString, referenceRange, findOptions)) {

bool foundStringIsCloser;

if (!closestStringRange)

foundStringIsCloser = true;

else {

foundStringIsCloser = isBackwardSearch

? is_gt(treeOrder<ComposedTree>(foundStringRange->end, closestStringRange->end))

: is_lt(treeOrder<ComposedTree>(foundStringRange->start, closestStringRange->start));

}

if (foundStringIsCloser)

closestStringRange = *foundStringRange;

}

}

return closestStringRange;

}

VisibleSelection AccessibilityObject::selection() const

{

RefPtr document = this->document();

RefPtr frame = document ? document->frame() : nullptr;

return frame ? frame->selection().selection() : VisibleSelection();

}

// Returns an collapsed range preceding the document contents if there is no selection.

// FIXME: Why is that behavior more useful than returning null in that case?

std::optional<SimpleRange> AccessibilityObject::selectionRange() const

{

RefPtr frame = this->frame();

if (!frame)

return std::nullopt;

if (auto range = frame->selection().selection().firstRange())

return *range;

Ref document = *frame->document();

return { { { document.get(), 0 }, { document.get(), 0 } } };

}

#if ENABLE(WRITING_TOOLS)

bool AccessibilityObject::writingToolsAvailable() const

{

RefPtr page = this->page();

return page && page->chrome().client().writingToolsAvailable();

}

#endif // ENABLE(WRITING_TOOLS)

std::optional<SimpleRange> AccessibilityObject::simpleRange() const

{

RefPtr node = this->node();

if (!node)

return std::nullopt;

std::optional stitchGroup = stitchGroupIfRepresentative();

if (!stitchGroup)

return AXObjectCache::rangeForNodeContents(*node);

// |this| is a stitching of multiple objects, so we need to include all of their contents in the range.

CheckedPtr cache = axObjectCache();

if (RefPtr endNode = cache ? lastNonAriaHiddenNode(stitchGroup->members(), *cache) : nullptr) {

if (std::optional range = makeSimpleRange(positionBeforeNode(*node), positionAfterNode(*endNode)))

return range;