[iOS] Active pointer map may fail to clear in presence of external gesture recognizer

lilyspiniolas · lilyspiniolas · commit 7b60c3fdb55b · 2026-01-28T10:48:33.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=306373 rdar://159227684 Reviewed by Abrar Rahman Protyasha. When a WKWebView is the subview of a parent view which itself has a custom gesture recognizer, the custom gesture recognizer may block gestures in such a way that `touchesBegan` fires for WebKit's touch gesture recognizer, but not `touchesEnded` or `touchesCancelled`. When this happens, we add an active pointer to the map in PointerCaptureController but never clear it since we never received a notification that the touch ended or was otherwise cancelled. When an active touch is present in the map, we do not create pointer events in `PointerCaptureController::pointerEventForMouseEvent`, so if the parent view later stops blocking touch gestures, WebKit may continue to fail to dispatch pointer and click events afterward. Resolve this by clearing the active pointer map when `reset` is called for `WKTouchEventsGestureRecognizer`. * Source/WebCore/page/PointerCaptureController.h: * Source/WebKit/UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::resetPointerCapture): * Source/WebKit/UIProcess/WebPageProxy.h: * Source/WebKit/UIProcess/ios/WKContentViewInteraction.h: * Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView _touchEventsGestureRecognizerReset]): * Source/WebKit/UIProcess/ios/WKTouchEventsGestureRecognizer.mm: (-[WKTouchEventsGestureRecognizer reset]): * Source/WebKit/WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::resetPointerCapture): * Source/WebKit/WebProcess/WebPage/WebPage.h: * Source/WebKit/WebProcess/WebPage/WebPage.messages.in: Canonical link: https://commits.webkit.org/306362@main
diff --git a/Source/WebCore/page/PointerCaptureController.h b/Source/WebCore/page/PointerCaptureController.h
@@ -56,7 +56,7 @@ class PointerCaptureController {
     ExceptionOr<void> setPointerCapture(Element*, PointerID);
     ExceptionOr<void> releasePointerCapture(Element*, PointerID);
     bool hasPointerCapture(Element*, PointerID);
-    void reset();
+    WEBCORE_EXPORT void reset();
 
     void pointerLockWasApplied();
     void elementWasRemoved(Element&);
diff --git a/Source/WebKit/UIProcess/WebPageProxy.cpp b/Source/WebKit/UIProcess/WebPageProxy.cpp
@@ -4895,6 +4895,11 @@ void WebPageProxy::touchWithIdentifierWasRemoved(WebCore::PointerID pointerId)
     send(Messages::WebPage::TouchWithIdentifierWasRemoved(pointerId));
 }
 
+void WebPageProxy::resetPointerCapture()
+{
+    send(Messages::WebPage::ResetPointerCapture());
+}
+
 void WebPageProxy::scrollBy(ScrollDirection direction, ScrollGranularity granularity)
 {
     if (!hasRunningProcess())
diff --git a/Source/WebKit/UIProcess/WebPageProxy.h b/Source/WebKit/UIProcess/WebPageProxy.h
@@ -1440,6 +1440,7 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
 
     void cancelPointer(WebCore::PointerID, const WebCore::IntPoint&);
     void touchWithIdentifierWasRemoved(WebCore::PointerID);
+    void resetPointerCapture();
 
     void scrollBy(WebCore::ScrollDirection, WebCore::ScrollGranularity);
     void centerSelectionInVisibleArea();
diff --git a/Source/WebKit/UIProcess/ios/WKContentViewInteraction.h b/Source/WebKit/UIProcess/ios/WKContentViewInteraction.h
@@ -1029,6 +1029,7 @@ FOR_EACH_PRIVATE_WKCONTENTVIEW_ACTION(DECLARE_WKCONTENTVIEW_ACTION_FOR_WEB_VIEW)
 
 - (BOOL)_shouldIgnoreTouchEvent:(UIEvent *)event;
 - (void)_touchEventsRecognized;
+- (void)_touchEventsGestureRecognizerReset;
 
 - (BOOL)_hasEnclosingScrollView:(UIView *)firstView matchingCriteria:(Function<BOOL(UIScrollView *)>&&)matchFunction;
 
diff --git a/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm b/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
@@ -2273,6 +2273,11 @@ - (void)_touchEventsRecognized
 #endif // ENABLE(TOUCH_EVENTS)
 }
 
+- (void)_touchEventsGestureRecognizerReset
+{
+    _page->resetPointerCapture();
+}
+
 #if ENABLE(TOUCH_EVENTS)
 - (void)_handleTouchActionsForTouchEvent:(const WebKit::NativeWebTouchEvent&)touchEvent
 {
diff --git a/Source/WebKit/UIProcess/ios/WKTouchEventsGestureRecognizer.mm b/Source/WebKit/UIProcess/ios/WKTouchEventsGestureRecognizer.mm
@@ -124,6 +124,8 @@ - (void)reset
     _lastTouchEvent.predictedEvents = { };
     _lastTouchesBeganTime = 0;
     _lastTouchesBeganLocation = std::nullopt;
+
+    [_contentView _touchEventsGestureRecognizerReset];
 }
 
 - (void)cancel
diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.cpp b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
@@ -4015,6 +4015,11 @@ void WebPage::touchWithIdentifierWasRemoved(WebCore::PointerID pointerId)
     m_page->pointerCaptureController().touchWithIdentifierWasRemoved(pointerId);
 }
 
+void WebPage::resetPointerCapture()
+{
+    m_page->pointerCaptureController().reset();
+}
+
 #if ENABLE(MAC_GESTURE_EVENTS)
 static HandleUserInputEventResult handleGestureEvent(FrameIdentifier frameID, const WebGestureEvent& event, Page* page)
 {
diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.h b/Source/WebKit/WebProcess/WebPage/WebPage.h
@@ -2305,6 +2305,7 @@ class WebPage final : public API::ObjectImpl<API::Object::Type::BundlePage>, pub
 
     void cancelPointer(WebCore::PointerID, const WebCore::IntPoint&);
     void touchWithIdentifierWasRemoved(WebCore::PointerID);
+    void resetPointerCapture();
 
 #if ENABLE(CONTEXT_MENUS)
     void didDismissContextMenu();
diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit/WebProcess/WebPage/WebPage.messages.in
@@ -177,6 +177,7 @@ messages -> WebPage WantsAsyncDispatchMessage {
 
     CancelPointer(WebCore::PointerID pointerId, WebCore::IntPoint documentPoint)
     TouchWithIdentifierWasRemoved(WebCore::PointerID pointerId)
+    ResetPointerCapture()
 
     DidEndColorPicker()
     DidChooseColor(WebCore::Color color)

Original file line number	Diff line number	Diff line change
`@@ -4895,6 +4895,11 @@ void WebPageProxy::touchWithIdentifierWasRemoved(WebCore::PointerID pointerId)`
`4895`	`4895`	`send(Messages::WebPage::TouchWithIdentifierWasRemoved(pointerId));`
`4896`	`4896`	`}`
`4897`	`4897`
	`4898`	`+void WebPageProxy::resetPointerCapture()`
	`4899`	`+{`
	`4900`	`+ send(Messages::WebPage::ResetPointerCapture());`
	`4901`	`+}`
	`4902`	`+`
`4898`	`4903`	`void WebPageProxy::scrollBy(ScrollDirection direction, ScrollGranularity granularity)`
`4899`	`4904`	`{`
`4900`	`4905`	`if (!hasRunningProcess())`
Original file line number	Diff line number	Diff line change
`@@ -2273,6 +2273,11 @@ - (void)_touchEventsRecognized`
`2273`	`2273`	`#endif // ENABLE(TOUCH_EVENTS)`
`2274`	`2274`	`}`
`2275`	`2275`
	`2276`	`+- (void)_touchEventsGestureRecognizerReset`
	`2277`	`+{`
	`2278`	`+ _page->resetPointerCapture();`
	`2279`	`+}`
	`2280`	`+`
`2276`	`2281`	`#if ENABLE(TOUCH_EVENTS)`
`2277`	`2282`	`- (void)_handleTouchActionsForTouchEvent:(const WebKit::NativeWebTouchEvent&)touchEvent`
`2278`	`2283`	`{`
Original file line number	Diff line number	Diff line change
`@@ -124,6 +124,8 @@ - (void)reset`
`124`	`124`	`_lastTouchEvent.predictedEvents = { };`
`125`	`125`	`_lastTouchesBeganTime = 0;`
`126`	`126`	`_lastTouchesBeganLocation = std::nullopt;`
	`127`	`+`
	`128`	`+ [_contentView _touchEventsGestureRecognizerReset];`
`127`	`129`	`}`
`128`	`130`
`129`	`131`	`- (void)cancel`
Original file line number	Diff line number	Diff line change
`@@ -4015,6 +4015,11 @@ void WebPage::touchWithIdentifierWasRemoved(WebCore::PointerID pointerId)`
`4015`	`4015`	`m_page->pointerCaptureController().touchWithIdentifierWasRemoved(pointerId);`
`4016`	`4016`	`}`
`4017`	`4017`
	`4018`	`+void WebPage::resetPointerCapture()`
	`4019`	`+{`
	`4020`	`+ m_page->pointerCaptureController().reset();`
	`4021`	`+}`
	`4022`	`+`
`4018`	`4023`	`#if ENABLE(MAC_GESTURE_EVENTS)`
`4019`	`4024`	`static HandleUserInputEventResult handleGestureEvent(FrameIdentifier frameID, const WebGestureEvent& event, Page* page)`
`4020`	`4025`	`{`