From e8b77cd890f7348c7875f596595c0095a94e4f86 Mon Sep 17 00:00:00 2001
From: FAIpang <73394302+FAIpang@users.noreply.github.com>
Date: Thu, 20 Aug 2026 12:28:26 +0800
Subject: [PATCH 1/2] webapi: reject elementFromPoint outside viewport

Add viewport bounds check to elementFromPoint function.
---
 src/browser/webapi/Document.zig | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/browser/webapi/Document.zig b/src/browser/webapi/Document.zig
index a90c7d14aa..64e1f6d6b6 100644
--- a/src/browser/webapi/Document.zig
+++ b/src/browser/webapi/Document.zig
@@ -875,6 +875,16 @@ pub fn moveBefore(self: *Document, node: js.Value, child: js.Value, frame: *Fram
 }
 
 pub fn elementFromPoint(self: *Document, x: f64, y: f64, frame: *Frame) !?*Element {
+    // CSSOM View requires the public hit-test APIs to reject coordinates
+    // outside the viewport before walking the document. Keep this check here
+    // so elementFromVerticalPoint can continue using document coordinates.
+    const viewport = frame._page.getViewport();
+    const width: f64 = @floatFromInt(viewport.width);
+    const height: f64 = @floatFromInt(viewport.height);
+    if (x < 0 or y < 0 or x > width or y > height) {
+        return null;
+    }
+
     return self.elementFromPointImpl(x, y, false, frame);
 }
 

From 90017785893b0f9fd2c95ada7779ba31d0ec0069 Mon Sep 17 00:00:00 2001
From: FAIpang <73394302+FAIpang@users.noreply.github.com>
Date: Thu, 20 Aug 2026 12:31:23 +0800
Subject: [PATCH 2/2] test: cover elementFromPoint viewport bounds

---
 .../tests/document/element_from_point.html    | 40 +++++++++++++++----
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/src/browser/tests/document/element_from_point.html b/src/browser/tests/document/element_from_point.html
index 0ee07debaf..7fde15421b 100644
--- a/src/browser/tests/document/element_from_point.html
+++ b/src/browser/tests/document/element_from_point.html
@@ -68,9 +68,24 @@
 
 <script id="outside_viewport">
 {
-  // Test points outside all elements
-  const element = document.elementFromPoint(-1000, -1000);
-  testing.expectEqual(null, element);
+  // CSSOM View requires viewport-external coordinates to return null.
+  const outsidePoints = [
+    [-1, 0],
+    [0, -1],
+    [window.innerWidth + 1, 10],
+    [0, window.innerHeight + 1],
+    // Coordinates observed on Taobao before the traversal hotspot.
+    [1248, 1932576],
+  ];
+
+  for (const [x, y] of outsidePoints) {
+    testing.expectEqual(null, document.elementFromPoint(x, y));
+  }
+
+  // The CSSOM View bounds are strict: coordinates equal to the dimensions
+  // are not rejected by the viewport guard.
+  testing.expectTrue(document.elementFromPoint(window.innerWidth, 10) !== null);
+  testing.expectTrue(document.elementFromPoint(10, window.innerHeight) !== null);
 }
 </script>
 
@@ -209,11 +224,20 @@
 
 <script id="elementsFromPoint_outside">
 {
-  // Test with point outside all elements
-  const elements = document.elementsFromPoint(-1000, -1000);
-
-  testing.expectTrue(Array.isArray(elements));
-  testing.expectEqual(0, elements.length);
+  // elementsFromPoint shares the viewport guard and returns an empty sequence.
+  const outsidePoints = [
+    [-1, 0],
+    [0, -1],
+    [window.innerWidth + 1, 10],
+    [0, window.innerHeight + 1],
+    [1248, 1932576],
+  ];
+
+  for (const [x, y] of outsidePoints) {
+    const elements = document.elementsFromPoint(x, y);
+    testing.expectTrue(Array.isArray(elements));
+    testing.expectEqual(0, elements.length);
+  }
 }
 </script>