From a8a8c7be010ea6fd4addbee3de320267a6f4dc8a Mon Sep 17 00:00:00 2001
From: Devin Rousso <devinrousso@microsoft.com>
Date: Mon, 6 Jul 2026 17:11:07 -0600
Subject: [PATCH 1/2] fix(webview): support input for elements inside
 cross-origin `<iframe>`

---
 packages/injected/src/webview/webViewInput.ts | 24 ++++++-
 .../src/server/webkit/webview/wvInput.ts      | 71 +++++++++----------
 .../src/server/webkit/webview/wvPage.ts       | 59 +++++++++++++--
 .../expectations/webkit-webview-page.txt      | 40 ++++-------
 4 files changed, 123 insertions(+), 71 deletions(-)

diff --git a/packages/injected/src/webview/webViewInput.ts b/packages/injected/src/webview/webViewInput.ts
index bddc78ae40621..2c83e9a53555d 100644
--- a/packages/injected/src/webview/webViewInput.ts
+++ b/packages/injected/src/webview/webViewInput.ts
@@ -66,6 +66,10 @@ function markAndDispatch(node: EventTarget, event: Event): boolean {
   return node.dispatchEvent(event);
 }
 
+function isFrameOwner(element: Element | null): element is HTMLIFrameElement | HTMLFrameElement {
+  return !!element && (element.localName === 'iframe' || element.localName === 'frame');
+}
+
 // Legacy WebKit-only KeyboardEvent.keyIdentifier (a DOM Level 3 draft property
 // dropped by every other engine). It cannot be supplied via the constructor, so
 // compute it from the virtual key code and define it on the event before
@@ -145,6 +149,19 @@ export class WebViewInput {
     return el;
   }
 
+  positionInIFrame(x: number, y: number): { iframe: HTMLIFrameElement | HTMLFrameElement | null, x: number, y: number } {
+    const target = this._deepElementFromPoint(x, y);
+    if (!isFrameOwner(target))
+      return { iframe: null, x, y };
+    const frameRect = target.getBoundingClientRect();
+    const frameStyle = this._window.getComputedStyle(target);
+    return {
+      iframe: target,
+      x: x - frameRect.left - parseFloat(frameStyle.borderLeftWidth) - parseFloat(frameStyle.paddingLeft),
+      y: y - frameRect.top - parseFloat(frameStyle.borderTopWidth) - parseFloat(frameStyle.paddingTop),
+    };
+  }
+
   // The focused element may live inside one or more shadow roots, where
   // document.activeElement only reports the outermost shadow host.
   private _deepActiveElement(): Element | null {
@@ -154,6 +171,11 @@ export class WebViewInput {
     return active;
   }
 
+  activeIFrame(): HTMLIFrameElement | HTMLFrameElement | null {
+    const active = this._deepActiveElement();
+    return isFrameOwner(active) ? active : null;
+  }
+
   private _insertText(target: Element | null, text: string) {
     if (target instanceof HTMLInputElement || target instanceof HTMLTextAreaElement) {
       const start = target.selectionStart ?? target.value.length;
@@ -350,7 +372,7 @@ export class WebViewInput {
       metaKey: params.metaKey,
     };
     try {
-      const touch = new Touch({ identifier: 0, target, clientX: params.x, clientY: params.y, screenX: params.x, screenY: params.y, pageX: params.x, pageY: params.y, radiusX: 1, radiusY: 1, rotationAngle: 0, force: 1 });
+      const touch = new Touch({ identifier: 0, target, clientX: params.x, clientY: params.y, screenX: params.x, screenY: params.y, pageX: params.x + this._window.scrollX, pageY: params.y + this._window.scrollY, radiusX: 1, radiusY: 1, rotationAngle: 0, force: 1 });
       void this._postTask(() => markAndDispatch(target, new TouchEvent('touchstart', { ...init, touches: [touch], targetTouches: [touch], changedTouches: [touch] })));
       void this._postTask(() => markAndDispatch(target, new TouchEvent('touchend', { ...init, touches: [], targetTouches: [], changedTouches: [touch] })));
     } catch {
diff --git a/packages/playwright-core/src/server/webkit/webview/wvInput.ts b/packages/playwright-core/src/server/webkit/webview/wvInput.ts
index 32ef4b46a8dae..bc0eb1decbe0b 100644
--- a/packages/playwright-core/src/server/webkit/webview/wvInput.ts
+++ b/packages/playwright-core/src/server/webkit/webview/wvInput.ts
@@ -18,8 +18,10 @@
 import * as input from '../../input';
 
 import type * as types from '../../types';
-import type { WVSession } from './wvConnection';
+import type * as frames from '../../frames';
+import type { Func1 } from '../../javascript';
 import type { Progress } from '../../progress';
+import type { WVPage } from './wvPage';
 
 function modifierFlags(modifiers: Set<types.KeyboardModifier>) {
   return {
@@ -51,11 +53,16 @@ function toButtonsMask(buttons: Set<types.MouseButton>): number {
   return mask;
 }
 
+async function evaluateInFrame<Arg>(progress: Progress, frame: frames.Frame, pageFunction: Func1<Arg, void>, arg: Arg): Promise<void> {
+  const context = await progress.race(frame.mainContext());
+  await progress.race(context.evaluate(pageFunction, arg));
+}
+
 export class RawKeyboardImpl implements input.RawKeyboard {
-  private _session: WVSession | undefined;
+  private _page: WVPage;
 
-  setSession(session: WVSession) {
-    this._session = session;
+  constructor(page: WVPage) {
+    this._page = page;
   }
 
   async keydown(progress: Progress, modifiers: Set<types.KeyboardModifier>, keyName: string, description: input.KeyDescription, autoRepeat: boolean): Promise<void> {
@@ -65,31 +72,33 @@ export class RawKeyboardImpl implements input.RawKeyboard {
       ...modifierFlags(modifiers),
       ...(text ? { text } : {}),
     };
-    await callWebViewInput(progress, this._session, 'keydown', params);
+    const frame = await this._page.deepestFocusedFrame(progress);
+    await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.keydown(p), params);
   }
 
   async keyup(progress: Progress, modifiers: Set<types.KeyboardModifier>, keyName: string, description: input.KeyDescription): Promise<void> {
     const { code, keyCode, key, location } = description;
     const params = { code, key, keyCode, location, ...modifierFlags(modifiers) };
-    await callWebViewInput(progress, this._session, 'keyup', params);
+    const frame = await this._page.deepestFocusedFrame(progress);
+    await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.keyup(p), params);
   }
 
   async sendText(progress: Progress, text: string): Promise<void> {
-    await callWebViewInput(progress, this._session, 'insertText', text);
+    const frame = await this._page.deepestFocusedFrame(progress);
+    await evaluateInFrame(progress, frame, t => (globalThis as any).__pwWebViewInput.insertText(t), text);
   }
 }
 
 export class RawMouseImpl implements input.RawMouse {
-  private _session: WVSession | undefined;
+  private _page: WVPage;
 
-  setSession(session: WVSession) {
-    this._session = session;
+  constructor(page: WVPage) {
+    this._page = page;
   }
 
   async move(progress: Progress, x: number, y: number, button: types.MouseButton | 'none', buttons: Set<types.MouseButton>, modifiers: Set<types.KeyboardModifier>, forClick: boolean): Promise<void> {
-    await callWebViewInput(progress, this._session, 'mouseMove', {
-      x, y, button: buttonToNumber(button), buttons: toButtonsMask(buttons), ...modifierFlags(modifiers),
-    });
+    const { frame, point } = await this._page.deepestFrameForPoint(progress, x, y);
+    await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.mouseMove(p), { ...point, button: buttonToNumber(button), buttons: toButtonsMask(buttons), ...modifierFlags(modifiers) });
   }
 
   async down(progress: Progress, x: number, y: number, button: types.MouseButton, buttons: Set<types.MouseButton>, modifiers: Set<types.KeyboardModifier>, clickCount: number): Promise<void> {
@@ -114,43 +123,27 @@ export class RawMouseImpl implements input.RawMouse {
   }
 
   async wheel(progress: Progress, x: number, y: number, buttons: Set<types.MouseButton>, modifiers: Set<types.KeyboardModifier>, deltaX: number, deltaY: number): Promise<void> {
-    await callWebViewInput(progress, this._session, 'wheel', { x, y, deltaX, deltaY, ...modifierFlags(modifiers) });
+    const { frame, point } = await this._page.deepestFrameForPoint(progress, x, y);
+    await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.wheel(p), { ...point, deltaX, deltaY, ...modifierFlags(modifiers) });
   }
 
   private async _mouseEvent(progress: Progress, type: string, x: number, y: number, button: number, buttons: number, modifiers: Set<types.KeyboardModifier>, clickCount: number) {
-    await callWebViewInput(progress, this._session, 'mouseEvent', {
-      type, x, y, button, buttons, clickCount, ...modifierFlags(modifiers),
+    const { frame, point } = await this._page.deepestFrameForPoint(progress, x, y);
+    await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.mouseEvent(p), {
+      type, ...point, button, buttons, clickCount, ...modifierFlags(modifiers),
     });
   }
 }
 
 export class RawTouchscreenImpl implements input.RawTouchscreen {
-  private _session: WVSession | undefined;
+  private _page: WVPage;
 
-  setSession(session: WVSession) {
-    this._session = session;
+  constructor(page: WVPage) {
+    this._page = page;
   }
 
   async tap(progress: Progress, x: number, y: number, modifiers: Set<types.KeyboardModifier>) {
-    await callWebViewInput(progress, this._session, 'tap', { x, y, ...modifierFlags(modifiers) });
-  }
-}
-
-async function callWebViewInput(progress: Progress, session: WVSession | undefined, method: string, arg: any): Promise<void> {
-  if (!session)
-    throw new Error('Page is not initialized');
-  const expression = `window.__pwWebViewInput.${method}(${JSON.stringify(arg)})`;
-  // Some dispatchers are async — they spread events across event-loop tasks the
-  // way a real device does. Await the returned promise so the action only
-  // resolves once every event has been delivered. Stock WebKit's Runtime.evaluate
-  // has no awaitPromise option, so use the separate Runtime.awaitPromise command.
-  const { result } = await progress.race(session.send('Runtime.evaluate', { expression, returnByValue: false }));
-  // `result` is absent if evaluation failed (e.g. the frame navigated away).
-  // Only promises carry an objectId here — every __pwWebViewInput method returns
-  // void or a Promise — so this both awaits async dispatch and avoids leaking a
-  // handle for the synchronous (void) case.
-  if (result?.className === 'Promise' && result.objectId) {
-    await progress.race(session.send('Runtime.awaitPromise', { promiseObjectId: result.objectId, returnByValue: true }));
-    session.sendMayFail('Runtime.releaseObject', { objectId: result.objectId });
+    const { frame, point } = await this._page.deepestFrameForPoint(progress, x, y);
+    await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.tap(p), { ...point, ...modifierFlags(modifiers) });
   }
 }
diff --git a/packages/playwright-core/src/server/webkit/webview/wvPage.ts b/packages/playwright-core/src/server/webkit/webview/wvPage.ts
index 3552a0bd6553f..d0e801f36d138 100644
--- a/packages/playwright-core/src/server/webkit/webview/wvPage.ts
+++ b/packages/playwright-core/src/server/webkit/webview/wvPage.ts
@@ -79,9 +79,9 @@ export class WVPage implements PageDelegate {
   constructor(browserContext: WVBrowserContext, outerSession: WVSession, dialogEndpoint?: string) {
     this._outerSession = outerSession;
     this._dialogEndpoint = dialogEndpoint;
-    this.rawKeyboard = new RawKeyboardImpl();
-    this.rawMouse = new RawMouseImpl();
-    this.rawTouchscreen = new RawTouchscreenImpl();
+    this.rawKeyboard = new RawKeyboardImpl(this);
+    this.rawMouse = new RawMouseImpl(this);
+    this.rawTouchscreen = new RawTouchscreenImpl(this);
     this._contextIdToContext = new Map();
     this._page = new Page(this, browserContext);
     this._workers = new WVWorkers(this._page, outerSession);
@@ -192,9 +192,6 @@ export class WVPage implements PageDelegate {
   private _setSession(session: WVSession) {
     eventsHelper.removeEventListeners(this._sessionListeners);
     this._session = session;
-    this.rawKeyboard.setSession(session);
-    this.rawMouse.setSession(session);
-    this.rawTouchscreen.setSession(session);
     this._workers.setSession(session);
     this._addSessionListeners();
   }
@@ -917,6 +914,56 @@ export class WVPage implements PageDelegate {
   async inputActionEpilogue(): Promise<void> {
   }
 
+  async deepestFrameForPoint(progress: Progress, x: number, y: number): Promise<{ frame: frames.Frame, point: types.Point }> {
+    const path = await this.framePointerPath(progress, x, y);
+    return path[path.length - 1];
+  }
+
+  async deepestFocusedFrame(progress: Progress): Promise<frames.Frame> {
+    let frame: frames.Frame = this._page.mainFrame();
+    for (;;) {
+      const context = await progress.race(frame.mainContext());
+      const iframe = await progress.race(context.evaluateHandle(() => (globalThis as any).__pwWebViewInput.activeIFrame())) as dom.ElementHandle;
+      const childFrame = await this._childFrameAndDispose(progress, iframe);
+      if (!childFrame)
+        break;
+      frame = childFrame;
+    }
+    return frame;
+  }
+
+  // Walk from the main frame into the deepest <iframe> that contains the point,
+  // recording each frame and the point translated into that frame's coordinates.
+  async framePointerPath(progress: Progress, x: number, y: number): Promise<{ frame: frames.Frame, point: types.Point }[]> {
+    const path: { frame: frames.Frame, point: types.Point }[] = [];
+    let frame: frames.Frame = this._page.mainFrame();
+    let point: types.Point = { x, y };
+    for (;;) {
+      path.push({ frame, point });
+      const context = await progress.race(frame.mainContext());
+      const position = await progress.race(context.evaluateHandle(p => (globalThis as any).__pwWebViewInput.positionInIFrame(p.x, p.y), point));
+      try {
+        const iframe = await position.getProperty(progress, 'iframe') as dom.ElementHandle;
+        const childFrame = await this._childFrameAndDispose(progress, iframe);
+        if (!childFrame)
+          break;
+        frame = childFrame;
+        point = await progress.race(position.evaluate(result => ({ x: result.x, y: result.y })));
+      } finally {
+        position.dispose();
+      }
+    }
+    return path;
+  }
+
+  private async _childFrameAndDispose(progress: Progress, iframe: dom.ElementHandle): Promise<frames.Frame | null> {
+    try {
+      return await progress.race(this.getContentFrame(iframe));
+    } finally {
+      iframe.dispose();
+    }
+  }
+
   async resetForReuse(progress: Progress): Promise<void> {
   }
 
diff --git a/tests/webview/expectations/webkit-webview-page.txt b/tests/webview/expectations/webkit-webview-page.txt
index 8383ec40ecfee..19cd7d7ef5cd7 100644
--- a/tests/webview/expectations/webkit-webview-page.txt
+++ b/tests/webview/expectations/webkit-webview-page.txt
@@ -70,6 +70,21 @@ page/page-screenshot.spec.ts › page screenshot › should work for webgl [fail
 page/page-screenshot.spec.ts › page screenshot › should work while navigating [fail]
 page/page-screenshot.spec.ts › page screenshot › should work with Array deleted [fail]
 
+# ============================================================================
+# mouse-offset-border-box  (3 tests)
+# The iOS 18 simulator WebView reports MouseEvent.offsetX/offsetY relative to
+# the border box, while Playwright — like Chromium, Firefox and recent desktop
+# WebKit — measures from the padding box (the long-standing WebKit "border box"
+# behavior, https://bugs.webkit.org/show_bug.cgi?id=135399). The click lands at
+# the correct coordinate; only the reported offset is larger by the element's
+# border width, so the offsetX/offsetY assertions fail. Platform reporting
+# difference, not an input-translation bug — drop once the simulator ships a
+# WebKit that measures from the padding box.
+# ============================================================================
+page/page-click.spec.ts › should click a button in scrolling container with offset [fail]
+page/page-click.spec.ts › should click the button with em border with offset [fail]
+page/page-click.spec.ts › should click the button with px border with offset [fail]
+
 # ============================================================================
 # frame-element-and-ownership  (remaining)
 # elementHandle.contentFrame / elementHandle.ownerFrame / frame.frameElement
@@ -89,11 +104,8 @@ page/frame-evaluate.spec.ts › should not allow cross-frame element handles whe
 page/frame-frame-element.spec.ts › should work inside closed shadow root [fail]
 page/frame-frame-element.spec.ts › should work inside declarative shadow root [fail]
 page/frame-goto.spec.ts › should return matching responses [fail]
-page/page-click.spec.ts › should click button inside frameset [fail]
-page/page-click.spec.ts › should click the button inside an iframe [fail]
 page/page-click.spec.ts › should not hang when frame is detached [fail]
 page/page-drag.spec.ts › Drag and drop › should work inside iframe [fail]
-page/page-keyboard.spec.ts › should type emoji into an iframe [fail]
 page/page-wait-for-selector-1.spec.ts › page.waitForSelector is shortcut for main frame [fail]
 
 # ============================================================================
@@ -181,13 +193,10 @@ page/page-request-fulfill.spec.ts › should fulfill with gzip and readback [fai
 # shielding, so DOM mutations between checks can detach the handle. Needs the
 # same retry-with-fresh-handle pattern that wkPage uses.
 # ============================================================================
-page/elementhandle-click.spec.ts › should double click the button [fail]
-page/elementhandle-click.spec.ts › should work with Node removed [fail]
 page/elementhandle-misc.spec.ts › should fill input [fail]
 page/elementhandle-misc.spec.ts › should hover [fail]
 page/elementhandle-misc.spec.ts › should hover when Node is removed [fail]
 page/elementhandle-scroll-into-view.spec.ts › should work @smoke [fail]
-page/elementhandle-select-text.spec.ts › should wait for visible [fail]
 page/locator-misc-2.spec.ts › should scroll into view [fail]
 page/page-keyboard.spec.ts › should handle selectAll [fail]
 page/page-screenshot.spec.ts › page screenshot animations › should not capture infinite css animation [fail]
@@ -231,23 +240,12 @@ page/page-autowaiting-basic.spec.ts › should work with waitForLoadState(load)
 page/page-basic.spec.ts › async stacks should work [fail]
 page/page-basic.spec.ts › has navigator.webdriver set to true [fail]
 page/page-basic.spec.ts › page.url should include hashes [fail]
-page/page-click-react.spec.ts › should not retarget when element is recycled on hover [fail]
 page/page-click-scroll.spec.ts › should scroll into view span element [fail]
-page/page-click-timeout-2.spec.ts › should timeout waiting for display:none to be gone [fail]
-page/page-click-timeout-2.spec.ts › should timeout waiting for visibility:hidden to be gone [fail]
-page/page-click-timeout-3.spec.ts › should report wrong hit target subtree [fail]
-page/page-click-timeout-3.spec.ts › should timeout waiting for hit target [fail]
-page/page-click-timeout-4.spec.ts › should timeout waiting for stable position [fail]
 page/page-click.spec.ts › ensure events are dispatched in the individual tasks [fail]
-page/page-click.spec.ts › should click a button in scrolling container with offset [fail]
-page/page-click.spec.ts › should click on checkbox input and toggle [fail]
-page/page-click.spec.ts › should click the button with em border with offset [fail]
-page/page-click.spec.ts › should click the button with px border with offset [fail]
 page/page-click.spec.ts › should fire contextmenu event on right click in correct order [fail]
 page/page-click.spec.ts › should set PointerEvent.pressure on pointerdown [fail]
 page/page-click.spec.ts › should set PointerEvent.pressure on pointermove [fail]
 page/page-dispatchevent.spec.ts › should dispatch absolute device orientation event [fail]
-page/page-drag.spec.ts › Drag and drop › should be able to drag the mouse in a frame [fail]
 page/page-drag.spec.ts › Drag and drop › should cancel on escape [fail]
 page/page-drag.spec.ts › Drag and drop › should work @smoke [fail]
 page/page-drag.spec.ts › Drag and drop › should work if the drag event is captured but not canceled [fail]
@@ -356,7 +354,6 @@ page/elementhandle-scroll-into-view.spec.ts › should wait for display:none to
 page/frame-evaluate.spec.ts › should work in iframes that interrupted initial javascript url navigation [fail]
 page/frame-goto.spec.ts › should reject when frame detaches [fail]
 page/page-aria-snapshot-ai.spec.ts › should snapshot a locator inside an iframe [fail]
-page/page-click-react.spec.ts › should not retarget when element changes on hover [fail]
 page/page-click.spec.ts › should not wait with noAutoWaiting 2 [fail]
 page/page-emulate-media.spec.ts › should report hover and fine pointer for desktop [fail]
 page/page-evaluate.spec.ts › should await promise from popup [fail]
@@ -427,7 +424,6 @@ page/page-request-fallback.spec.ts › should work [fail]
 page/page-route.spec.ts › should not support ? in glob pattern [fail]
 page/page-screenshot.spec.ts › page screenshot › should capture canvas changes [fail]
 page/page-screenshot.spec.ts › page screenshot › should work with odd clip size on Retina displays [fail]
-page/page-select-option.spec.ts › should select only first option [fail]
 page/page-set-input-files.spec.ts › should upload large file [fail]
 page/page-set-input-files.spec.ts › should upload large file with relative path [fail]
 page/page-wait-for-load-state.spec.ts › should wait for load state of newPage [fail]
@@ -506,7 +502,6 @@ page/page-autowaiting-no-hang.spec.ts › calling window.stop sync [fail]
 # Pre-existing (fails on main too): a same-document navigation via the Navigation
 # API does not update the frame URL on the stock WebView backend.
 page/page-autowaiting-no-hang.spec.ts › clicking a link intercepted by the Navigation API same-document [fail]
-page/page-click.spec.ts › should wait for becoming hit target [fail]
 page/page-drag.spec.ts › Drag and drop › should respect the drop effect [fail]
 page/page-drag.spec.ts › Drag and drop › should work if a frame is stalled [fail]
 page/page-evaluate.spec.ts › should return -Infinity [fail]
@@ -540,7 +535,6 @@ page/to-match-aria-snapshot.spec.ts › should not match what is not matched [fa
 page/frame-evaluate.spec.ts › should work in iframes that interrupted initial javascript url navigation [fail]
 page/locator-frame.spec.ts › should work for iframe @smoke [fail]
 page/locator-frame.spec.ts › should work for nested iframe [fail]
-page/locator-frame.spec.ts › should work with COEP/COOP/CORP isolated iframe [fail]
 page/page-add-init-script.spec.ts › init script should run only once in iframe [fail]
 page/page-aria-snapshot-ai.spec.ts › return empty snapshot when iframe is not loaded [fail]
 page/page-aria-snapshot-ai.spec.ts › should limit depth across iframe boundary [fail]
@@ -558,9 +552,6 @@ page/page-click.spec.ts › should click a button that is overlaid by a permissi
 page/page-click.spec.ts › should click in a nested transformed iframe [fail]
 page/page-click.spec.ts › should click in a transformed iframe [fail]
 page/page-click.spec.ts › should click in a transformed iframe with force [fail]
-page/page-click.spec.ts › should click in an iframe with border [fail]
-page/page-click.spec.ts › should click in an iframe with border 2 [fail]
-page/page-click.spec.ts › should click the button inside an iframe [fail]
 page/page-click.spec.ts › should click the button with fixed position inside an iframe [fail]
 page/page-click.spec.ts › should issue clicks in parallel in page and popup [fail]
 page/page-drag.spec.ts › Drag and drop › iframe › should drag into an iframe [fail]
@@ -672,7 +663,6 @@ page/network-post-data.spec.ts › should get post data for navigator.sendBeacon
 page/page-add-init-script.spec.ts › should work after a cross origin navigation [fail]
 page/page-autowaiting-basic.spec.ts › should await cross-process navigation when clicking anchor [fail]
 page/page-autowaiting-basic.spec.ts › should await form-get on click [fail]
-page/page-basic.spec.ts › frame.press should work [fail]
 page/page-basic.spec.ts › page.close should work with window.close [fail]
 page/page-basic.spec.ts › should provide access to the opener page [fail]
 page/page-click-scroll.spec.ts › should scroll into view display:contents [fail]

From b49ebf296188b5f8d83d0d1f624bccfe22f0bbdd Mon Sep 17 00:00:00 2001
From: Devin Rousso <devinrousso@microsoft.com>
Date: Mon, 6 Jul 2026 17:37:58 -0600
Subject: [PATCH 2/2] fix(webview): maintain hover state when the mouse crosses
 an `<iframe>`

each `<iframe>` has its own mouse position

as such, moving the pointer into or out of an `<iframe>` did not dispatch `mouseleave`/`mouseout`/etc.

instead, track what `<iframe>` are hovered on the server so that movement is coordinated globally
---
 packages/injected/src/webview/webViewInput.ts | 19 +++++++-
 .../src/server/webkit/webview/wvInput.ts      | 19 +++++++-
 tests/page/page-mouse.spec.ts                 | 46 +++++++++++++++++++
 3 files changed, 81 insertions(+), 3 deletions(-)

diff --git a/packages/injected/src/webview/webViewInput.ts b/packages/injected/src/webview/webViewInput.ts
index 2c83e9a53555d..f2c5465ce2fb8 100644
--- a/packages/injected/src/webview/webViewInput.ts
+++ b/packages/injected/src/webview/webViewInput.ts
@@ -291,6 +291,7 @@ export class WebViewInput {
       metaKey: params.metaKey,
     };
     const pointer: PointerEventInit = { ...base, pointerId: 1, pointerType: 'mouse', isPrimary: true };
+    let lastTask = Promise.resolve();
     const prev = this._hoverTarget;
     if (prev !== target) {
       if (prev && prev.isConnected) {
@@ -302,13 +303,29 @@ export class WebViewInput {
       void this._postTask(() => markAndDispatch(target, new PointerEvent('pointerover', { ...pointer, relatedTarget: prev })));
       void this._postTask(() => markAndDispatch(target, new MouseEvent('mouseover', { ...base, relatedTarget: prev })));
       void this._postTask(() => markAndDispatch(target, new PointerEvent('pointerenter', { ...pointer, bubbles: false, cancelable: false, relatedTarget: prev })));
-      void this._postTask(() => markAndDispatch(target, new MouseEvent('mouseenter', { ...base, bubbles: false, cancelable: false, relatedTarget: prev })));
+      lastTask = this._postTask(() => markAndDispatch(target, new MouseEvent('mouseenter', { ...base, bubbles: false, cancelable: false, relatedTarget: prev })));
       this._hoverTarget = target;
     }
+    // Movements within an <iframe> are not dispatched in the owner context.
+    if (isFrameOwner(target))
+      return lastTask;
     void this._postTask(() => markAndDispatch(target, new PointerEvent('pointermove', pointer)));
     return this._postTask(() => markAndDispatch(target, new MouseEvent('mousemove', base)));
   }
 
+  clearHover(): Promise<void> {
+    const prev = this._hoverTarget;
+    this._hoverTarget = null;
+    if (!prev?.isConnected)
+      return Promise.resolve();
+    const base: MouseEventInit = { bubbles: true, cancelable: true, view: this._window, relatedTarget: null };
+    const pointer: PointerEventInit = { ...base, pointerId: 1, pointerType: 'mouse', isPrimary: true };
+    void this._postTask(() => markAndDispatch(prev, new PointerEvent('pointerout', pointer)));
+    void this._postTask(() => markAndDispatch(prev, new MouseEvent('mouseout', base)));
+    void this._postTask(() => markAndDispatch(prev, new PointerEvent('pointerleave', { ...pointer, bubbles: false, cancelable: false })));
+    return this._postTask(() => markAndDispatch(prev, new MouseEvent('mouseleave', { ...base, bubbles: false, cancelable: false })));
+  }
+
   mouseEvent(params: MouseEventParams): Promise<void> {
     // Resolve the hit target at dispatch time, not enqueue time: a queued move
     // ahead of this may reveal an overlay that should receive the press.
diff --git a/packages/playwright-core/src/server/webkit/webview/wvInput.ts b/packages/playwright-core/src/server/webkit/webview/wvInput.ts
index bc0eb1decbe0b..dc76eecade852 100644
--- a/packages/playwright-core/src/server/webkit/webview/wvInput.ts
+++ b/packages/playwright-core/src/server/webkit/webview/wvInput.ts
@@ -91,14 +91,29 @@ export class RawKeyboardImpl implements input.RawKeyboard {
 
 export class RawMouseImpl implements input.RawMouse {
   private _page: WVPage;
+  private _lastHoveredFrames: frames.Frame[] = [];
 
   constructor(page: WVPage) {
     this._page = page;
   }
 
   async move(progress: Progress, x: number, y: number, button: types.MouseButton | 'none', buttons: Set<types.MouseButton>, modifiers: Set<types.KeyboardModifier>, forClick: boolean): Promise<void> {
-    const { frame, point } = await this._page.deepestFrameForPoint(progress, x, y);
-    await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.mouseMove(p), { ...point, button: buttonToNumber(button), buttons: toButtonsMask(buttons), ...modifierFlags(modifiers) });
+    const path = await this._page.framePointerPath(progress, x, y);
+    const params = { button: buttonToNumber(button), buttons: toButtonsMask(buttons), ...modifierFlags(modifiers) };
+    // Each frame tracks its own hover target, so as the pointer crosses an <iframe>
+    // boundary it must leave the frames it is no longer within (deepest first) before
+    // entering the frames along the new path. A move that stays within the same frames
+    // leaves none of them, so no cross-frame mouseout/mouseleave is dispatched.
+    const hoveredFrames = path.map(entry => entry.frame);
+    const attachedFrames = this._page._page.frameManager.frames();
+    for (const frame of this._lastHoveredFrames.reverse()) {
+      if (hoveredFrames.includes(frame) || !attachedFrames.includes(frame))
+        continue;
+      await evaluateInFrame(progress, frame, () => (globalThis as any).__pwWebViewInput.clearHover(), undefined);
+    }
+    this._lastHoveredFrames = hoveredFrames;
+    for (const { frame, point } of path)
+      await evaluateInFrame(progress, frame, p => (globalThis as any).__pwWebViewInput.mouseMove(p), { ...params, ...point });
   }
 
   async down(progress: Progress, x: number, y: number, button: types.MouseButton, buttons: Set<types.MouseButton>, modifiers: Set<types.KeyboardModifier>, clickCount: number): Promise<void> {
diff --git a/tests/page/page-mouse.spec.ts b/tests/page/page-mouse.spec.ts
index 196cfc6d33cc1..ccfba3840f2ee 100644
--- a/tests/page/page-mouse.spec.ts
+++ b/tests/page/page-mouse.spec.ts
@@ -337,3 +337,49 @@ it('should dispatch mouse move after context menu was opened', async ({ page, br
     }
   }
 });
+
+it('should track hover across iframe boundaries', async ({ page, headless }) => {
+  it.skip(!headless, 'headed messes up with hover');
+
+  await page.setContent(`
+    <style>
+      body, html { margin: 0; padding: 0; }
+      #parentBox { position: absolute; left: 10px; top: 10px; width: 100px; height: 100px; }
+      iframe { position: absolute; left: 200px; top: 10px; width: 200px; height: 200px; border: none; }
+    </style>
+    <div id="parentBox"></div>
+    <iframe srcdoc="
+      <style>body, html { margin: 0; padding: 0; } #childBox { width: 180px; height: 180px; }</style>
+      <div id='childBox'></div>
+      <script>
+        const box = document.querySelector('#childBox');
+        box.addEventListener('mouseenter', () => window.top.__log.push('child:enter'));
+        box.addEventListener('mouseleave', () => window.top.__log.push('child:leave'));
+      </script>
+    "></iframe>
+    <script>
+      window.__log = [];
+      const box = document.querySelector('#parentBox');
+      box.addEventListener('mouseenter', () => window.__log.push('parent:enter'));
+      box.addEventListener('mouseleave', () => window.__log.push('parent:leave'));
+    </script>
+  `);
+  await page.waitForSelector('iframe');
+  await page.frames()[1].waitForSelector('#childBox');
+  const log = () => page.evaluate(() => window['__log']);
+  const parentBox = (await page.locator('#parentBox').boundingBox())!;
+  const iframeBox = (await page.locator('iframe').boundingBox())!;
+  const parentCenter = { x: parentBox.x + parentBox.width / 2, y: parentBox.y + parentBox.height / 2 };
+  const childCenter = { x: iframeBox.x + 90, y: iframeBox.y + 90 };
+
+  await page.mouse.move(parentCenter.x, parentCenter.y);
+  await expect.poll(log).toEqual(['parent:enter']);
+
+  // Crossing into the iframe leaves the parent element and enters the child.
+  await page.mouse.move(childCenter.x, childCenter.y);
+  await expect.poll(log).toEqual(['parent:enter', 'parent:leave', 'child:enter']);
+
+  // Crossing back out leaves the child element and re-enters the parent.
+  await page.mouse.move(parentCenter.x, parentCenter.y);
+  await expect.poll(log).toEqual(['parent:enter', 'parent:leave', 'child:enter', 'child:leave', 'parent:enter']);
+});