fix(webview): support iOS 26 site isolation and fix input/postData

Stock Mobile Safari on iOS 26 site-isolates frames, reporting a separate
Target.targetCreated with type 'frame' for every page (even pages without
iframes). wvPage asserted page-only targets and threw, breaking the entire
WebView suite. Ignore non-page frame targets (resuming any paused ones) and
drive the page through the top-level page target.

Also fixes three input/network bugs uncovered once the suite ran again:
- postData: stock WebKit reports Network.Request.postData as a plain string,
  not base64 like the patched fork — decode as utf8.
- keyboard: synthetic key events never performed the default text insertion,
  so press/type left inputs unchanged — emulate insertion honoring selection.
- mouse: move() only dispatched mousemove — fire the full out/leave ->
  over/enter -> move sequence (mouse + pointer) when the hovered element
  changes, so hover-driven UI reacts.

Removes the 56 now-passing tests from the webkit-webview-page expectations
and recategorizes the remaining genuine failures.

Author: yury-s

packages/playwright-core/src/server/webkit/webview/wvInput.ts

@@ -77,9 +77,25 @@ export class RawKeyboardImpl implements input.RawKeyboard {
     const expr = `(() => {
       const t = document.activeElement || document.body;
       const init = { bubbles: true, cancelable: true, view: window, code: ${JSON.stringify(code)}, key: ${JSON.stringify(key)}, keyCode: ${keyCode}, which: ${keyCode}, location: ${location}, repeat: ${autoRepeat}, ctrlKey: ${mods.ctrlKey}, shiftKey: ${mods.shiftKey}, altKey: ${mods.altKey}, metaKey: ${mods.metaKey} };
-      const dispatch = e => { Object.defineProperty(e, '__pwTrustedSynthetic', { value: true }); t.dispatchEvent(e); };
-      dispatch(new KeyboardEvent('keydown', init));
-      ${text ? `dispatch(new KeyboardEvent('keypress', { ...init, charCode: ${charCode}, keyCode: ${charCode}, which: ${charCode} }));` : ''}
+      const dispatch = e => { Object.defineProperty(e, '__pwTrustedSynthetic', { value: true }); return t.dispatchEvent(e); };
+      const notPrevented = dispatch(new KeyboardEvent('keydown', init));
+      ${text ? `const charNotPrevented = dispatch(new KeyboardEvent('keypress', { ...init, charCode: ${charCode}, keyCode: ${charCode}, which: ${charCode} }));
+      // Synthetic key events do not perform the browser's default text-insertion,
+      // so emulate it here (honoring the current selection) unless the page
+      // cancelled keydown/keypress.
+      if (notPrevented && charNotPrevented) {
+        const text = ${JSON.stringify(text)};
+        if (t instanceof HTMLInputElement || t instanceof HTMLTextAreaElement) {
+          const start = t.selectionStart ?? t.value.length;
+          const end = t.selectionEnd ?? t.value.length;
+          t.value = t.value.slice(0, start) + text + t.value.slice(end);
+          const pos = start + text.length;
+          try { t.setSelectionRange(pos, pos); } catch {}
+          t.dispatchEvent(new InputEvent('input', { bubbles: true, cancelable: false, data: text, inputType: 'insertText' }));
+        } else if (t && t.isContentEditable) {
+          document.execCommand('insertText', false, text);
+        }
+      }` : ''}
     })()`;
     await evalInPage(progress, this._session, expr);
   }
@@ -123,7 +139,37 @@ export class RawMouseImpl implements input.RawMouse {
   }
 
   async move(progress: Progress, x: number, y: number, button: types.MouseButton | 'none', buttons: Set<types.MouseButton>, modifiers: Set<types.KeyboardModifier>, forClick: boolean): Promise<void> {
-    await this._dispatchMouse(progress, 'mousemove', x, y, buttonToNumber(button), toButtonsMask(buttons), modifiers, 0);
+    const mods = modifierFlags(modifiers);
+    const buttonCode = buttonToNumber(button);
+    const buttonsMask = toButtonsMask(buttons);
+    // A real pointer move fires the full out/leave -> over/enter -> move sequence
+    // (both mouse and pointer flavors) whenever the element under the pointer
+    // changes. Synthetic dispatch must replicate it, otherwise hover-driven UI
+    // (e.g. interstitials listening for mouseover/pointerover) never reacts.
+    const expr = `(() => {
+      const x = ${x}, y = ${y};
+      const target = (${kDeepElementFromPointSrc})(x, y) || document.documentElement;
+      const base = { bubbles: true, cancelable: true, view: window, clientX: x, clientY: y, screenX: x, screenY: y, button: ${buttonCode}, buttons: ${buttonsMask}, ctrlKey: ${mods.ctrlKey}, shiftKey: ${mods.shiftKey}, altKey: ${mods.altKey}, metaKey: ${mods.metaKey} };
+      const pointer = { ...base, pointerId: 1, pointerType: 'mouse', isPrimary: true };
+      const fire = (Ctor, type, node, init) => { const e = new Ctor(type, init); Object.defineProperty(e, '__pwTrustedSynthetic', { value: true }); node.dispatchEvent(e); };
+      const prev = window.__pwHoverTarget || null;
+      if (prev !== target) {
+        if (prev && prev.isConnected) {
+          fire(PointerEvent, 'pointerout', prev, { ...pointer, relatedTarget: target });
+          fire(MouseEvent, 'mouseout', prev, { ...base, relatedTarget: target });
+          fire(PointerEvent, 'pointerleave', prev, { ...pointer, bubbles: false, cancelable: false, relatedTarget: target });
+          fire(MouseEvent, 'mouseleave', prev, { ...base, bubbles: false, cancelable: false, relatedTarget: target });
+        }
+        fire(PointerEvent, 'pointerover', target, { ...pointer, relatedTarget: prev });
+        fire(MouseEvent, 'mouseover', target, { ...base, relatedTarget: prev });
+        fire(PointerEvent, 'pointerenter', target, { ...pointer, bubbles: false, cancelable: false, relatedTarget: prev });
+        fire(MouseEvent, 'mouseenter', target, { ...base, bubbles: false, cancelable: false, relatedTarget: prev });
+        window.__pwHoverTarget = target;
+      }
+      fire(PointerEvent, 'pointermove', target, pointer);
+      fire(MouseEvent, 'mousemove', target, base);
+    })()`;
+    await evalInPage(progress, this._session, expr);
   }
 
   async down(progress: Progress, x: number, y: number, button: types.MouseButton, buttons: Set<types.MouseButton>, modifiers: Set<types.KeyboardModifier>, clickCount: number): Promise<void> {

packages/playwright-core/src/server/webkit/webview/wvInterceptableRequest.ts

@@ -56,8 +56,11 @@ export class WVInterceptableRequest {
     let postDataBuffer = null;
     this._timestamp = event.timestamp;
     this._wallTime = event.walltime * 1000;
-    if (event.request.postData)
-      postDataBuffer = Buffer.from(event.request.postData, 'base64');
+    if (event.request.postData) {
+      // Stock WebKit reports Network.Request.postData as a plain string, unlike
+      // the Playwright-patched WebKit build which base64-encodes it.
+      postDataBuffer = Buffer.from(event.request.postData, 'utf8');
+    }
     this.request = new network.Request(frame._page.browserContext, frame, null, redirectedFrom?.request || null, documentId, event.request.url,
         resourceType, event.request.method, postDataBuffer, headersObjectToArray(event.request.headers));
   }

packages/playwright-core/src/server/webkit/webview/wvPage.ts

@@ -210,7 +210,15 @@ export class WVPage implements PageDelegate {
 
   private async _onTargetCreated(event: Protocol.Target.targetCreatedPayload) {
     const { targetInfo } = event;
-    assert(targetInfo.type === 'page', 'Only page targets are expected in WebView, received: ' + targetInfo.type);
+    if (targetInfo.type !== 'page') {
+      // Site-isolated WebKit (iOS 26+) reports a separate target per frame. We
+      // drive the whole page through the top-level page target, so out-of-process
+      // frame targets are not attached. Resume any paused ones so navigation in
+      // the owning page is not blocked waiting on them.
+      if (targetInfo.isPaused)
+        this._outerSession.sendMayFail('Target.resume', { targetId: targetInfo.targetId });
+      return;
+    }
     const session = this._createSession(targetInfo.targetId);
     if (!targetInfo.isProvisional) {
       let pageOrError: Page | Error;

tests/webview/expectations/webkit-webview-page.txt

@@ -123,76 +123,56 @@ page/elementhandle-screenshot.spec.ts › element screenshot › should not issu
 page/locator-misc-1.spec.ts › should focus and blur a button [fail]
 
 # ============================================================================
-# execution-context-destroyed  (65 tests)
-# Cross-navigation handle invalidation is racy on stock RDP — execution
-# contexts are reported destroyed before our frame manager learns about the
-# navigation. Needs proper Runtime.executionContextsCleared wiring in wvPage.
-# ============================================================================
-page/elementhandle-convenience.spec.ts › innerHTML should work [fail]
-page/elementhandle-convenience.spec.ts › innerText should work [fail]
-page/elementhandle-convenience.spec.ts › textContent should work [fail]
-page/elementhandle-misc.spec.ts › should fill input when Node is removed [fail]
-page/elementhandle-misc.spec.ts › should select single option [fail]
-page/elementhandle-press.spec.ts › should not modify selection when focused [fail]
-page/elementhandle-query-selector.spec.ts › should query existing element [fail]
-page/elementhandle-select-text.spec.ts › should select input [fail]
-page/elementhandle-select-text.spec.ts › should select textarea [fail]
-page/elementhandle-type.spec.ts › should not modify selection when focused [fail]
-page/elementhandle-wait-for-element-state.spec.ts › should wait for stable position [fail]
+# service-worker  (2 tests)
+# Service-worker request interception/reporting is unsupported on the stock
+# WebView backend; routing a request through a service worker tears down the
+# session ('Target closed').
+# ============================================================================
 page/interception.spec.ts › should intercept after a service worker [fail]
-page/locator-click.spec.ts › should double click the button [fail]
-page/locator-element-handle.spec.ts › xpath should query existing element [fail]
-page/locator-list.spec.ts › locator.all should work [fail]
-page/locator-misc-2.spec.ts › should select textarea [fail]
-page/network-post-data.spec.ts › should return post data for PUT requests [fail]
-page/network-post-data.spec.ts › should return post data w/o content-type @smoke [fail]
-page/page-add-init-script.spec.ts › should support multiple scripts [fail]
-page/page-add-locator-handler.spec.ts › should not work with force:true [fail]
-page/page-add-locator-handler.spec.ts › should work › mouseover 1 times [fail]
-page/page-add-script-tag.spec.ts › should work with a content and type=module [fail]
-page/page-add-style-tag.spec.ts › should include sourceURL when path is provided [fail]
-page/page-aria-snapshot.spec.ts › should include pseudo codepoints [fail]
+page/page-event-request.spec.ts › should report requests and responses handled by service worker with routing [fail]
+
+# ============================================================================
+# out-of-process-iframe  (1 test)
+# iOS 26 site-isolates frames into their own targets, which wvPage does not
+# attach — it drives the page through the top-level page target only. Actions
+# that must reach inside a cross-origin iframe therefore time out.
+# ============================================================================
 page/page-click-scroll.spec.ts › should scroll into view element in iframe [fail]
-page/page-click.spec.ts › should click on checkbox label and toggle [fail]
-page/page-click.spec.ts › should click the button after navigation [fail]
-page/page-click.spec.ts › should fail when element detaches after animation [fail]
-page/page-click.spec.ts › should not wait with force [fail]
-page/page-click.spec.ts › should report nice error when element is detached and force-clicked [fail]
-page/page-click.spec.ts › should waitFor display:none to be gone [fail]
-page/page-click.spec.ts › should waitFor visibility:hidden to be gone [fail]
-page/page-click.spec.ts › should waitFor visible when parent is hidden [fail]
+
+# ============================================================================
+# native-drag-and-drop  (1 test)
+# Synthetic mouse events cannot drive WebKit's native HTML5 drag controller, so
+# dragstart/dragenter/dragover/drop are never produced for draggable elements.
+# ============================================================================
 page/page-drag.spec.ts › Drag and drop › should send the right events [fail]
-page/page-evaluate.spec.ts › should work with overridden globalThis.Window/Document/Node › () => globalThis.Window = null [fail]
-page/page-evaluate.spec.ts › should work with overridden globalThis.Window/Document/Node › () => globalThis.Window = {} [fail]
-page/page-event-request.spec.ts › should report requests and responses handled by service worker with routing [fail]
-page/page-event-request.spec.ts › should return last requests [fail]
-page/page-fill.spec.ts › input event.composed should be true and cross shadow dom boundary - color [fail]
-page/page-fill.spec.ts › should fill different input types [fail]
-page/page-fill.spec.ts › should retry on disabled element [fail]
-page/page-fill.spec.ts › should retry on invisible element [fail]
-page/page-fill.spec.ts › should retry on readonly element [fail]
-page/page-fill.spec.ts › should throw on unsupported inputs [fail]
-page/page-history.spec.ts › page.reload should not resolve with same-document navigation [fail]
-page/page-keyboard.spec.ts › insertText should only emit input event [fail]
-page/page-keyboard.spec.ts › should have correct Keydown/Keyup order when pressing Escape key [fail]
-page/page-keyboard.spec.ts › should report multiple modifiers [fail]
-page/page-keyboard.spec.ts › should report shiftKey [fail]
-page/page-keyboard.spec.ts › should specify location [fail]
-page/page-mouse.spec.ts › should set modifier keys on click [fail]
-page/page-network-request.spec.ts › should parse the json post data [fail]
-page/page-route.spec.ts › should intercept when postData is more than 1MB [fail]
-page/page-route.spec.ts › should pause intercepted fetch request until continue [fail]
+
+# ============================================================================
+# screenshot-animations  (4 tests)
+# screenshot({ animations: 'disabled' }) cannot freeze or advance animations
+# over the stock RDP (no Playwright screenshot patches), so animation-sensitive
+# screenshot comparisons differ.
+# ============================================================================
 page/page-screenshot.spec.ts › page screenshot animations › should capture screenshots after layoutchanges in transitionend event › make sure transition is actually running [fail]
 page/page-screenshot.spec.ts › page screenshot animations › should fire transitionend for finite transitions › make sure transition is actually running [fail]
 page/page-screenshot.spec.ts › page screenshot animations › should not capture css animations in shadow DOM [fail]
 page/page-screenshot.spec.ts › page screenshot animations › should not capture pseudo element css animation [fail]
-page/page-screenshot.spec.ts › page screenshot animations › should not change animation with playbackRate equal to 0 [fail]
-page/page-screenshot.spec.ts › page screenshot animations › should resume infinite animations [fail]
-page/page-select-option.spec.ts › should wait for multiple options to be present [fail]
-page/page-select-option.spec.ts › should wait for option index to be present [fail]
-page/page-wait-for-selector-1.spec.ts › should report logs while waiting for hidden [fail]
-page/retarget.spec.ts › input value retargeting › "label" in "<label     >Text <input id=target></label>" input value [fail]
-page/selectors-css.spec.ts › should work for open shadow roots [fail]
+
+# ============================================================================
+# network-request-tracking  (1 test)
+# Rapidly-issued requests are occasionally dropped from the page's request log
+# on the stock RDP, so the full ordered list comes back incomplete.
+# ============================================================================
+page/page-event-request.spec.ts › should return last requests [fail]
+
+# ============================================================================
+# redirect-interception  (3 tests)
+# Request interception across HTTP redirects is incomplete on the stock WebView
+# backend — redirected (and redirected subresource) requests are not surfaced
+# to the route handler, and the final navigation response comes back null.
+# ============================================================================
+page/page-route.spec.ts › should not work with redirects [fail]
+page/page-route.spec.ts › should chain fallback w/ dynamic URL [fail]
+page/page-route.spec.ts › should work with redirects for subresources [fail]
 
 # ============================================================================
 # element-not-attached  (11 tests)