251925 2023-02-08 09:13:06 -0800 [WPE] Compatibility mapping with mouse events use too naive target node detection 2023-02-08 09:13:06 -0800 1 1 1 Unclassified WebKit WPE WebKit WebKit Nightly Build Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=248076 P2 Normal --- 1 bst webkit-unassigned bugs-noreply cgarcia zdobersek oldest_to_newest 1932030 0 464907 bst 2023-02-08 09:13:06 -0800 Created attachment 464907 Demo: Touch compatibility mapping with mouse events trigger on wrong element WPE sends mouse motion/down/up in PageClientImpl::doneWithTouchEvent() for touches as compatibility mapping with mouse events [1]. Instead of reusing the target node (result of the hit test) from the touch events, completely new synthetic input events are created that rely solely on the X/Y coordinates of the touch event (see TouchGestureController::EventVariant()). Since all of this happens after the touch gesture is done, the new hit test triggered by the synthetic input events can be a different target node (i.e. if the DOM changes under the touch point as a result of the touchstart event). This again can lead to events on wrong elements. See attachment for a demo. This also affects the contextmenu handling in https://bugs.webkit.org/show_bug.cgi?id=248076 because it imitates the click handling. [1] https://www.w3.org/TR/pointerevents/#compatibility-mapping-with-mouse-events 464907 2023-02-08 09:13:06 -0800 2023-02-08 09:13:06 -0800 Demo: Touch compatibility mapping with mouse events trigger on wrong element compat-touch-mouse-events.html text/html 1737 bst PGh0bWw+CjxoZWFkPgo8c2NyaXB0PgpmdW5jdGlvbiBtYWluKCkgewoJdmFyIGJ0biA9IGRvY3Vt ZW50LmdldEVsZW1lbnRCeUlkKCJidG4iKTsKCWJ0bi5hZGRFdmVudExpc3RlbmVyKCJ0b3VjaHN0 YXJ0IiwgKGUpID0+IHsKCQlzZXRUaW1lb3V0KCgpID0+IHsKCQkJbGV0IHBhcmVudCA9IGRvY3Vt ZW50LmdldEVsZW1lbnRCeUlkKCJvdmVybGF5ZGl2Iik7CgkJCWxldCBvdmVybGF5X2J0biA9IGRv Y3VtZW50LmNyZWF0ZUVsZW1lbnQoImJ1dHRvbiIpOwoJCQlwYXJlbnQuc3R5bGUudmlzaWJpbGl0 eSA9ICJ2aXNpYmxlIjsKCQkJb3ZlcmxheV9idG4uY2xhc3NMaXN0LmFkZCgiYmlnYnRuMiIpOwoJ CQlvdmVybGF5X2J0bi5pbm5lclRleHQgPSAib3ZlcmxheSBidXR0b24iOwoJCQlwYXJlbnQuaW5z ZXJ0QmVmb3JlKG92ZXJsYXlfYnRuLCBwYXJlbnQuZmlyc3RFbGVtZW50Q2hpbGQpOwoJCQlvdmVy bGF5X2J0bi5hZGRFdmVudExpc3RlbmVyKCJjbGljayIsIChlKSA9PiB7CgkJCQlvdmVybGF5X2J0 bi5pbm5lclRleHQgPSAib3ZlcmxheSBidXR0b24gd2FzIGFjY2lkZW50YWxseSg/KSBjbGlja2Vk IjsKCQkJfSk7CgkJfSwgMTAwKTsKCX0pOwp9CndpbmRvdy5vbmxvYWQgPSBtYWluOwo8L3Njcmlw dD4KPHN0eWxlPgouYmlnYnRuIHsKCXdpZHRoOiA0MCU7CgloZWlnaHQ6IDIwJTsKCWJhY2tncm91 bmQtY29sb3I6ICNmODQ7Cgl1c2VyLXNlbGVjdDogbm9uZTsKCS13ZWJraXQtdXNlci1zZWxlY3Q6 IG5vbmU7Cn0KCi5iaWdidG4yIHsKCXdpZHRoOiAxMDAlOwoJaGVpZ2h0OiAxMDAlOwoJYmFja2dy b3VuZC1jb2xvcjogI2NjYzsKCXBvc2l0aW9uOiBhYnNvbHV0ZTsKCXVzZXItc2VsZWN0OiBub25l OwoJLXdlYmtpdC11c2VyLXNlbGVjdDogbm9uZTsKfQoKLm92ZXJsYXkgewoJd2lkdGg6IDQwJTsK CWhlaWdodDogMjAlOwoJei1pbmRleDogMTAwOwoJdmlzaWJpbGl0eTogaGlkZGVuOwoJcG9zaXRp b246IGFic29sdXRlOwoJdG9wOiAwcHg7CglsZWZ0OiAwcHg7Cn0KCi5leHBsYW5hdGlvbiB7Cglt YXJnaW4tdG9wOiAxJTsKCXdpZHRoOiA0MCU7Cn0KCiNyZWxvYWRidG4gewoJd2lkdGg6IDIwJTsK CWhlaWdodDogNSU7Cn0KPC9zdHlsZT4KPC9oZWFkPgo8Ym9keSBvbmNvbnRleHRtZW51PSJyZXR1 cm4gZmFsc2U7Ij4KCTxidXR0b24gaWQ9ImJ0biIgY2xhc3M9ImJpZ2J0biI+dG91Y2gsIGhvbGQg YW5kIGRvbid0IG1vdmUgZm9yIDEgc2Vjb25kPC9idXR0b24+Cgk8ZGl2IGlkPSJvdmVybGF5ZGl2 IiBjbGFzcz0ib3ZlcmxheSI+PC9kaXY+CgoJPGRpdiBjbGFzcz0iZXhwbGFuYXRpb24iPgoJCVRv dWNoIGdlc3R1cmVzIHRyaWdnZXJpbmcKCQk8YSBocmVmPSJodHRwczovL3d3dy53My5vcmcvVFIv cG9pbnRlcmV2ZW50cy8jY29tcGF0aWJpbGl0eS1tYXBwaW5nLXdpdGgtbW91c2UtZXZlbnRzIj5j b21wYXRpYmlsaXR5IG1hcHBpbmcgd2l0aCBtb3VzZSBldmVudHM8L2E+CgkJc2hvdWxkIGJlIGVt aXR0ZWQgb24gdGhlIHNhbWUgdGFyZ2V0IGVsZW1lbnQuCgkJVGVzdCB0aGlzIGJ5IHNob3dpbmcg YSBidXR0b24gb3ZlcmxheWluZyBvbiB0b3VjaHN0YXJ0IGFuZCB0ZXN0aW5nIHdoZXRoZXIgaXQg YWNjaWRlbnRhbGx5IHJlY2VpdmVzIHRoZSBjbGljayBldmVudC4KCTwvZGl2PgoJPGJ1dHRvbiBp ZD0icmVsb2FkYnRuIiBvbmNsaWNrPSJkb2N1bWVudC5sb2NhdGlvbi5yZWxvYWQoKTsiPlJlbG9h ZDwvYnV0dG9uPgo8L2JvZHk+CjwvaHRtbD4K