From acb6b835fee3662a70554974d779b30f3fae03e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Arrufat?= <adria.arrufat@gmail.com>
Date: Thu, 17 Sep 2026 18:05:02 +0200
Subject: [PATCH 1/2] cdp: DOM.getFrameOwner returns the owner <iframe>, nodes
 carry frameId

DOM.getFrameOwner answered with the child frame's document instead of the
element hosting it. Clients that map an <iframe> to its frame compare the
backendNodeId it returns with the one they resolved in the parent
(Stagehand's frameLocator/deepLocator, Playwright's contentFrame), so the
lookup never matched and they could not descend into frames.

Return the owner element, as Chrome does, and error for the main frame.
The node writer now emits frameId on frame-owner elements and on document
nodes, which is the other half of that pairing.
---
 src/server/cdp/Node.zig        | 28 ++++++++++++++++---
 src/server/cdp/domains/dom.zig | 49 +++++++++++++++++++++++++++++++++-
 2 files changed, 72 insertions(+), 5 deletions(-)

diff --git a/src/server/cdp/Node.zig b/src/server/cdp/Node.zig
index fc45ad5fb..85c54f7cd 100644
--- a/src/server/cdp/Node.zig
+++ b/src/server/cdp/Node.zig
@@ -22,8 +22,10 @@
 const std = @import("std");
 const lp = @import("lightpanda");
 
+const id = @import("id.zig");
 const Frame = @import("../../browser/Frame.zig");
 const DOMNode = @import("../../browser/webapi/Node.zig");
+const IFrame = @import("../../browser/webapi/element/html/IFrame.zig");
 const NodeRegistry = @import("../../NodeRegistry.zig");
 
 const log = lp.log;
@@ -67,12 +69,12 @@ pub const Search = struct {
         }
 
         pub fn create(self: *List, nodes: []const *DOMNode) !Search {
-            const id = self.search_id;
-            defer self.search_id = id +% 1;
+            const search_id = self.search_id;
+            defer self.search_id = search_id +% 1;
 
             const arena = self.arena.allocator();
 
-            const name = switch (id) {
+            const name = switch (search_id) {
                 0 => "0",
                 1 => "1",
                 2 => "2",
@@ -83,7 +85,7 @@ pub const Search = struct {
                 7 => "7",
                 8 => "8",
                 9 => "9",
-                else => try std.fmt.allocPrint(arena, "{d}", .{id}),
+                else => try std.fmt.allocPrint(arena, "{d}", .{search_id}),
             };
 
             var registry = self.registry;
@@ -217,9 +219,27 @@ pub const Writer = struct {
 
             try w.objectField("localName");
             try w.write(element.getLocalName());
+
+            // Chrome names the hosted frame on frame-owner elements; that's how
+            // clients pair an <iframe> with its Page.frameAttached id.
+            if (element.is(IFrame)) |iframe| {
+                if (iframe.getContentDocument()) |document| {
+                    if (document._frame) |child| {
+                        try w.objectField("frameId");
+                        try w.write(&id.toFrameId(child._frame_id));
+                    }
+                }
+            }
         } else {
             try w.objectField("localName");
             try w.write("");
+
+            if (dom_node._type == .document) {
+                if (dom_node.subtype(DOMNode.Document)._frame) |frame| {
+                    try w.objectField("frameId");
+                    try w.write(&id.toFrameId(frame._frame_id));
+                }
+            }
         }
 
         try w.objectField("nodeType");
diff --git a/src/server/cdp/domains/dom.zig b/src/server/cdp/domains/dom.zig
index 0861216ec..1a6a92d7d 100644
--- a/src/server/cdp/domains/dom.zig
+++ b/src/server/cdp/domains/dom.zig
@@ -610,7 +610,14 @@ fn getFrameOwner(cmd: *CDP.Command) !void {
         return cmd.sendError(-32000, "Frame with the given id does not belong to the target.", .{});
     };
 
-    const node = try bc.node_registry.register(frame.window._document.asNode());
+    // The element hosting the frame, as in Chrome; the main frame has none.
+    // Clients (Stagehand's frameLocator, Playwright's contentFrame) match this
+    // backendNodeId against the <iframe> they resolved in the parent.
+    const iframe = frame.iframe orelse {
+        return cmd.sendError(-32000, "Frame with the given id does not belong to the target.", .{});
+    };
+
+    const node = try bc.node_registry.register(iframe.asNode());
     return cmd.sendResult(.{ .nodeId = node.id, .backendNodeId = node.id }, .{});
 }
 
@@ -1313,6 +1320,46 @@ test "cdp.dom: resolveNode into a child frame's context" {
     try ctx.expectSentError(-31998, "ContextNotFound", .{ .id = 15 });
 }
 
+test "cdp.dom: getFrameOwner returns the owner iframe element" {
+    var ctx = try testing.context();
+    defer ctx.deinit();
+
+    const bc = try ctx.loadBrowserContext(.{ .id = "BID-FO", .url = "cdp/isolated_world.html", .target_id = "FID-000000000X".* });
+    const root = bc.mainFrame() orelse unreachable;
+    const child = root.child_frames.items[0];
+    const iframe_node = try bc.node_registry.register(child.iframe.?.asNode());
+
+    try ctx.processMessage(.{ .id = 10, .method = "DOM.getFrameOwner", .sessionId = "SID-X", .params = .{
+        .frameId = &id.toFrameId(child._frame_id),
+    } });
+    try ctx.expectSentResult(.{ .nodeId = iframe_node.id, .backendNodeId = iframe_node.id }, .{ .id = 10 });
+
+    // The owner element names the frame it hosts.
+    try ctx.processMessage(.{ .id = 11, .method = "DOM.describeNode", .sessionId = "SID-X", .params = .{
+        .backendNodeId = iframe_node.id,
+    } });
+    try ctx.expectSentResult(.{ .node = .{
+        .localName = "iframe",
+        .frameId = &id.toFrameId(child._frame_id),
+    } }, .{ .id = 11 });
+
+    // So does a document, for its own frame.
+    const child_document = try bc.node_registry.register(child.window._document.asNode());
+    try ctx.processMessage(.{ .id = 12, .method = "DOM.describeNode", .sessionId = "SID-X", .params = .{
+        .backendNodeId = child_document.id,
+    } });
+    try ctx.expectSentResult(.{ .node = .{
+        .nodeName = "#document",
+        .frameId = &id.toFrameId(child._frame_id),
+    } }, .{ .id = 12 });
+
+    // The main frame has no owner.
+    try ctx.processMessage(.{ .id = 13, .method = "DOM.getFrameOwner", .sessionId = "SID-X", .params = .{
+        .frameId = &id.toFrameId(root._frame_id),
+    } });
+    try ctx.expectSentError(-32000, "Frame with the given id does not belong to the target.", .{ .id = 13 });
+}
+
 fn mainWorldContextId(bc: *CDP.BrowserContext, frame: *const Frame) !i32 {
     var ls: js.Local.Scope = undefined;
     frame.js.localScope(&ls);

From dcc90d60c9869fb69d220947e13ad24497412645 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Arrufat?= <adria.arrufat@gmail.com>
Date: Fri, 18 Sep 2026 09:23:32 +0200
Subject: [PATCH 2/2] cdp: emit frameId on the document element, not the
 document node

Chrome sets frameId on frame-owner elements and on the element whose
parent is the document, never on the document node itself.
---
 src/server/cdp/Node.zig        | 19 ++++++++++---------
 src/server/cdp/domains/dom.zig |  8 ++++----
 2 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/src/server/cdp/Node.zig b/src/server/cdp/Node.zig
index 85c54f7cd..eaefba5e8 100644
--- a/src/server/cdp/Node.zig
+++ b/src/server/cdp/Node.zig
@@ -220,8 +220,9 @@ pub const Writer = struct {
             try w.objectField("localName");
             try w.write(element.getLocalName());
 
-            // Chrome names the hosted frame on frame-owner elements; that's how
-            // clients pair an <iframe> with its Page.frameAttached id.
+            // Chrome names the hosted frame on frame-owner elements and the own
+            // frame on the document element; that's how clients pair an <iframe>
+            // with its Page.frameAttached id.
             if (element.is(IFrame)) |iframe| {
                 if (iframe.getContentDocument()) |document| {
                     if (document._frame) |child| {
@@ -229,17 +230,17 @@ pub const Writer = struct {
                         try w.write(&id.toFrameId(child._frame_id));
                     }
                 }
+            } else if (dom_node._parent) |dom_parent| {
+                if (dom_parent._type == .document) {
+                    if (dom_parent.subtype(DOMNode.Document)._frame) |frame| {
+                        try w.objectField("frameId");
+                        try w.write(&id.toFrameId(frame._frame_id));
+                    }
+                }
             }
         } else {
             try w.objectField("localName");
             try w.write("");
-
-            if (dom_node._type == .document) {
-                if (dom_node.subtype(DOMNode.Document)._frame) |frame| {
-                    try w.objectField("frameId");
-                    try w.write(&id.toFrameId(frame._frame_id));
-                }
-            }
         }
 
         try w.objectField("nodeType");
diff --git a/src/server/cdp/domains/dom.zig b/src/server/cdp/domains/dom.zig
index 1a6a92d7d..ac2028414 100644
--- a/src/server/cdp/domains/dom.zig
+++ b/src/server/cdp/domains/dom.zig
@@ -1343,13 +1343,13 @@ test "cdp.dom: getFrameOwner returns the owner iframe element" {
         .frameId = &id.toFrameId(child._frame_id),
     } }, .{ .id = 11 });
 
-    // So does a document, for its own frame.
-    const child_document = try bc.node_registry.register(child.window._document.asNode());
+    // So does the document element, for its own frame.
+    const child_html = try bc.node_registry.register(child.window._document.getDocumentElement().?.asNode());
     try ctx.processMessage(.{ .id = 12, .method = "DOM.describeNode", .sessionId = "SID-X", .params = .{
-        .backendNodeId = child_document.id,
+        .backendNodeId = child_html.id,
     } });
     try ctx.expectSentResult(.{ .node = .{
-        .nodeName = "#document",
+        .localName = "html",
         .frameId = &id.toFrameId(child._frame_id),
     } }, .{ .id = 12 });