Bug 306672

Summary:	If completeSyntheticClick provides a non-root frameID, resolve to root frame.
Product:	WebKit	Reporter:	jlee53
Component:	WebKit Misc.	Assignee:	jlee53
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

jlee53

Reported 2026-01-30 17:23:29 PST

Sometimes, completeSyntheticClick receives a frameID that may not be a root frame. Without validation, this frameID is passed directly to localRootFrame(), which expects a root frame identifier. We fix this by ensuring completeSyntheticClick always resolves the frameID to a root frame before calling localRootFrame()

Attachments
Add attachment proposed patch, testcase, etc.

jlee53

Comment 1 2026-01-30 17:24:09 PST

<rdar://problem/168161516>

jlee53

Comment 2 2026-01-30 17:28:10 PST

Pull request: https://github.com/WebKit/WebKit/pull/57606

EWS

Comment 3 2026-02-03 23:22:47 PST

Committed 306757@main (cbb65e5cfe2d): <https://commits.webkit.org/306757@main> Reviewed commits have been landed. Closing PR #57606 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.