1524996 - Prevent content process from taking focus except when responding to click/tap

Status: NEW

(Core :: DOM: UI Events & Focus Handling, enhancement, P3)

Description

[Henri Sivonen (:hsivonen)]

Post-MVP for event delivery to out-of-process iframes, we should investigate if its feasible / Web-compatible to restrict focus-grabbing by content processes so that a content process may receive focus only by another process handing it off (traversal by tabbing or a page focusing its child frame by JS) or by responding to a click/tap targeted to content hosted by the process that wishes to grab focus.

Comment 1

[Henri Sivonen (:hsivonen)]

Likely implementation in TabParent:

• In SendFooEvent and in NavigateByKey, set a timestamp on TabParent.
• In RecvRequestFocus, if the timestamp is too old, don't honor the request.

Comment 2

[James Teh [:Jamie]]

Take focus requests from accessibility need to be allowed as well. Screen readers often set focus in response to user actions (e.g. the user moving the screen reader's review cursor or choosing to interact with a control). This is done via accessibility APIs, not click/tap. Note that on Windows, these requests originate from within the content process, since a11y clients talk directly to the accessibility tree in the content process. That said, we might be able to change this to do some async messaging with the parent process.

Comment 3

[Chris Peterson [:cpeterson]]

(In reply to Henri Sivonen (:hsivonen) from comment #0)

Post-MVP for event delivery to out-of-process iframes

Post-MVP means Fission Milestone "Future"