From 4186ea490f4c6892b22e454f935f6264240f6a6e Mon Sep 17 00:00:00 2001
From: Viktor Vaczi <viktor.vaczi@emergence-engineering.com>
Date: Sat, 13 Jun 2026 17:39:34 +0200
Subject: [PATCH] test(wasm-dom): repros + fixes for the text-ctrl reentry and
 tooltip UAF bugs

Bump wxwidgets (8814ddb) for the two DOM-port fixes and add their reproductions:

- tests/apps/standalone/{textctrl-reentry,tooltip-lifetime}: standalone wx repro
  apps + Makefile.wasm targets (textctrl links -fexceptions to throw from a
  wxEVT_TEXT handler), driven by tests/e2e/dom-port-bugs.spec.ts. Each app is
  deterministic and self-contained (no UB, ASAN, or timing dependence).
- docs/features/wx-dom-port/branch-review.md: branch review with findings #2/#3
  marked fixed and a "Bug reproductions and fixes" section, including the
  asyncify + legacy-EH gotcha (catch/destructor landing pads are unreliable
  while unwinding through asyncify frames).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/features/wx-dom-port/branch-review.md    | 235 ++++++++++++++++++
 tests/apps/Makefile.wasm                      |  25 +-
 .../textctrl-reentry_test.cpp                 | 104 ++++++++
 .../tooltip-lifetime_test.cpp                 | 105 ++++++++
 tests/e2e/dom-port-bugs.spec.ts               |  73 ++++++
 wxwidgets                                     |   2 +-
 6 files changed, 542 insertions(+), 2 deletions(-)
 create mode 100644 docs/features/wx-dom-port/branch-review.md
 create mode 100644 tests/apps/standalone/textctrl-reentry/textctrl-reentry_test.cpp
 create mode 100644 tests/apps/standalone/tooltip-lifetime/tooltip-lifetime_test.cpp
 create mode 100644 tests/e2e/dom-port-bugs.spec.ts

diff --git a/docs/features/wx-dom-port/branch-review.md b/docs/features/wx-dom-port/branch-review.md
new file mode 100644
index 0000000..984daa9
--- /dev/null
+++ b/docs/features/wx-dom-port/branch-review.md
@@ -0,0 +1,235 @@
+# `feature/wx-dom-port` — branch review (every change vs main)
+
+**Date:** 2026-06-13
+**Scope:** the complete diff of `feature/wx-dom-port` against each repo's mainline
+(root `main`, kicad/wxwidgets `wasm-port`, pcbjam-shared `main`).
+**Method:** the wx core touches, the async core, the JS layer, the build system,
+and all root scripts/specs/docs were read line-by-line; the ~30 additive
+`src/wasm/*` control files were read in full by four parallel readers and
+cross-checked (especially for the menubar use-after-free class). Two baseline
+screenshots were opened to confirm the renders are real.
+
+## Verdict
+
+Clean, careful, well-commented work that **reduces** the wxWidgets fork's
+divergence from upstream rather than growing it, and leaves KiCad untouched.
+The DOM-event architecture is sound (fresh-entry dispatch, freed windows
+unregistered before destruction). There are a few real loose ends — one of
+which (CI) is a functional breakage — plus two known feature gaps and two
+latent lifetime/async hazards worth tracking. None of them block promoting the
+branch.
+
+## Fast-forward status
+
+The branch is zero-divergence against every mainline (`behind: 0` everywhere),
+so each promotion is a true fast-forward — no merge commit, no force.
+
+| Repo | Target → feature | FF? | Commits | Notes |
+|---|---|---|---|---|
+| root | `main` → `feature/wx-dom-port` | yes | 23 | local `main` == `origin/main` (`14ca16c`) |
+| wxwidgets | `wasm-port` → feature | yes | 20 | `origin/wasm-port` is an ancestor; HEAD `d33769ab56` |
+| kicad | `wasm-port` → feature | no-op | 0 | feature HEAD `693c513293` **==** `origin/wasm-port` |
+| pcbjam-shared | `main` → … | no-op | 0 | detached HEAD `92b2634` **==** `origin/main` |
+
+Two mechanics to remember:
+
+1. The feature branch is **unpushed** (no `origin/feature/wx-dom-port`), and the
+   submodules have **no local `wasm-port` branch** — only `origin/wasm-port`. So
+   "fast-forward `wasm-port`" is a fast-forward *push*, not a local merge:
+   ```
+   git -C wxwidgets push origin feature/wx-dom-port:wasm-port   # 20 commits
+   # kicad: nothing to push (already == origin/wasm-port)
+   git push origin feature/wx-dom-port:main                      # root, 23 commits
+   ```
+   Push **wxwidgets before root** so the published `main` references an
+   already-published submodule commit.
+2. pcbjam-shared's *local* `main` branch is stale (`5f27571`) vs `origin/main`
+   (`92b2634`); irrelevant to the recorded pointer, just don't FF that local
+   branch without fetching.
+
+## What changed, by repo
+
+| Repo | Net | Nature |
+|---|---|---|
+| **kicad** | 0 commits | Fork untouched — divergence not increased. |
+| **pcbjam-shared** | 0 | Unchanged. |
+| **wxwidgets** | +9,632 / −54,725, 161 files | The substance (below). The −54.7k is dominated by a junk `configure~` backup (−50,075) and the deleted canvas theme `src/univ/themes/wasm.cpp` (−2,960). |
+| **root** | 36 text files + 339 baseline PNGs | Build-script renames, DOM test wiring, docs. |
+
+## wxwidgets — full audit
+
+### 1. Cleanup / divergence reduction
+- Deleted `configure~` (a 50,075-line committed editor backup) and
+  `src/univ/themes/wasm.cpp` (the 2,960-line canvas renderer the DOM port
+  replaces).
+- The `src/generic/*`, `src/aui/*`, `src/common/prntbase.cpp`,
+  `src/propgrid/propgrid.cpp`, `src/stc/stc.cpp` touches are **all
+  `__EMSCRIPTEN__`-gated** and are *removals/refactors* of the old canvas-port
+  element-tracking hooks into a clean `wx/wasm/elementtracker.h` API
+  (`WasmRegisterRenderedElement(...)` → `wxWasmTrackElement(...)`, and
+  screen-coords → parent-relative for DOM positioning). Native builds are
+  byte-identical; the WASM-side divergence shrinks.
+  Representative: `framemanager.cpp`, `grid.cpp`, `tabg.cpp` (pure removal),
+  `ctrlrend.cpp`. `prntbase.cpp` adds only `|| defined(__WXWASM__)` to one
+  preprocessor condition (PostScript DC — no native printer in WASM).
+
+### 2. Additive DOM port (~30 new `src/wasm/*.cpp` + `include/wx/wasm/*.h`)
+Each wx control maps onto a real DOM element. Read in full and found clean
+apart from the findings table below. Intentional stubs are clearly TODO-tagged.
+
+- **Buttons / static:** `control`, `anybutton`, `button`, `bmpbuttn`, `tglbtn`,
+  `checkbox`, `radiobut`, `stattext`, `statline`, `statbox`, `statbmp`, `gauge`.
+  `bmpbuttn` intentionally pushes its bitmap twice (documented: `wxButton::Create`'s
+  `SetLabel` clears the `<img>`).
+- **Text:** `textentry` (mixin) + `textctrl` (`<input>`/`<textarea>`). Caret/
+  selection cache logic is sound; an `m_inDomInput` re-entry guard prevents
+  echo-back.
+- **Choice / list / range:** `choice`, `combobox`, `listbox`, `checklst`,
+  `radiobox`, `slider`, `spinbutt`, `scrolbar`. Item/client-data/selection
+  arrays stay in lockstep; selection-index adjustment on insert/delete is
+  correct.
+- **Chrome / containers:** `frame`, `menu`, `menuitem`, `toolbar`, `notebook`,
+  `tooltip`, `elementtracker`. The menubar `Detach()` fix
+  (`parent->RemoveChild(this)` before the base) is present and correct (see
+  `docs/features/async/10`); notebook tab-strip geometry reflow is sound.
+
+### 3. wx core touches (`src/univ/*`)
+Mostly net deletions of canvas element-tracking. The one substantial *unguarded*
+change is **`univ/menu.cpp` (+98/−495): the universal popup menu's submenu/
+overflow timers were removed** (`SUBMENU_TIMEOUT`, `m_subMenuTimer`,
+`m_overflowTimer`, `OnOverflowTimer`, `HasOverflow*`, `OverflowArrowHitTest`,
+mouse-wheel handling, `IsPointTrackingToSubMenu`), plus an event-table tweak
+(`EVT_LEFT_DCLICK` → `EVT_LEFT_UP`, `+EVT_MOUSE_CAPTURE_LOST`). This is
+asyncify-hostile machinery; it lives in shared univ code, but the fork only ever
+builds WASM and the menu e2e tests pass. The paired `include/wx/univ/*.h`
+changes are small interface adjustments (e.g. `GetScrollbarArrowSize()` made
+pure-virtual).
+
+### 4. Async core — highest-risk area, all sound
+- **`domevents.cpp` (new):** `wx_dom_event` / `wx_dom_mouse` are top-level
+  `EMSCRIPTEN_KEEPALIVE` entries — **fresh WASM entries, not re-entrant on
+  Asyncify-suspended frames** — which is what makes DOM input safe even mid-modal
+  (this resolves the original diagnosis plan's central fear). `~wxWindowWasm`
+  calls `wxDomUnregisterWindow(m_domId)` *first*, so a freed window's stale
+  `domId` is a harmless `gs_domWindows` lookup-miss.
+- **`window.cpp`:** the DOM geometry/clip walk (`UpdateDomGeometry` /
+  `ComputeAncestorClip` / `UpdateDomGeometryRecursive`) with the notebook
+  client-area-origin correction; `OnDomEvent(FOCUSIN)` → `SetFocus` guarded by
+  `gs_focusWindow != this`; destructor tears down the DOM node before
+  `UnregisterElement`; `EraseBackgroundWindow` now fills the bg colour to avoid
+  black pixels.
+- **`app.cpp`:** mouse-wheel hierarchy walk (fresh event copy per hop, stops at
+  handled/TLW); **stateless** keyboard arbitration via `document.activeElement`
+  (documented rationale: Firefox doesn't fire `focusout` when a focused element
+  is removed, which previously wedged a flag and swallowed all keys).
+- **`clipbrd.cpp`:** net change is a clarifying NOTE that `js_clipboardHasText`
+  must never run on the idle path. **`settings.cpp`:** a classic light
+  system-colour scheme (else backgrounds erase to black). **`nonownedwnd.cpp`:**
+  the main frame starts `m_isShown=true`. **`popupwin.cpp`:** drops an unused
+  univ `EVT_SIZE` table.
+
+### 5. JS layer
+- **`build/wasm/wx-dom.js` (1,212 lines, new):** only 5 `console.error` calls,
+  all legitimate error reporting; no stray `console.log`, no `debugger`, no
+  TODO/FIXME/HACK.
+- **`build/wasm/wx.js`:** adds one worker-guarded `window.__wxGetWindowElement`
+  accessor; no canvas-port behaviour change.
+
+### 6. Build system
+`Makefile.in` / `build/bakefiles/files.bkl` / `configure` register the new files;
+`include/wx/*.h` are mechanical `#elif defined(__WXWASM__)` dispatch hooks. The
+MSW `makefile.gcc` / `makefile.vc` churn is bakefile-regeneration byproduct
+(adding wasm widgets to `files.bkl` re-emitted every platform's makefile) —
+harmless for a WASM-only fork.
+
+## root — full audit
+
+- **Build/infra renames** propagated consistently: `build-wxuniversal-wasm.sh →
+  build-wx-wasm.sh`, `wxwidgets-universal → wxwidgets`, drop `--enable-universal`,
+  lib prefix `wasmunivu → wasmu` (`docker/build.sh`, `env.sh`,
+  `FindwxWidgets.cmake`, `build-kicad-target.sh`, `Makefile.wasm`,
+  `gal-regression/wasm/Makefile`, README/CLAUDE/build.md).
+- **Real fixes inside the renames:** `docker/build.sh` and `setup-kicad-wasm.sh`
+  correct a wx.js source path (`build-wasm/wxwidgets/build/wasm/...` →
+  `wxwidgets/build/wasm/...`) and ship `wx-dom.js`. `build-wx-wasm.sh` adds
+  `autoconf_inc.m4`/`Makefile.in` staleness checks so new sources trigger
+  reconfigure. `build-wasm-test.sh` adds `-j${JOBS}`. `Makefile.wasm` adds
+  `wx-dom.js` as a second `--pre-js` to every link, lists `JS_FILES` as explicit
+  prereqs (shim edits relink), and uses `$(filter %.o %.a,$^)` so the new `.js`
+  prereqs aren't passed as link inputs.
+- **Tests:** `boot.spec.ts` (new no-screenshot smoke: registry fills,
+  `wxDomPort===true`, zero page errors); `appearance.spec.ts` (new DOM-port
+  regression: notebook tab round-trips, wheel scrolling with viewport clipping,
+  rows surviving tab switches); `wxwidgets.spec.ts` switches the `wxChoice` test
+  to drive a native `<select>` via `selectOption` and bypasses Playwright's
+  actionability check in `clickCanvas` (real elements now cover the canvas);
+  `setup-kicad-wasm.sh` gets the wx.js path fix + `wx-dom.js` sync.
+- **Docs:** new `docs/features/wx-dom-port/README.md` and `visual-notes.md`
+  (architecture, e2e-verified status, known gaps, fork surface, phase-by-phase
+  visual notes); the async dossier `08`/`09`/`10`.
+- **Screenshots:** 338 baselines + 1 pre-existing root-level
+  `wizard-04-finish-headless.png`; 319 modified / 8 added / 12 deleted — the
+  expected re-render churn for a port that draws controls as DOM elements (the
+  12 deletions include baselines for the removed choice-reopen steps). Spot-check
+  confirmed real renders (wx form controls; KiCad pl_editor with native menu
+  bar/toolbar/notebook).
+
+## Findings
+
+| # | Severity | Where | Issue |
+|---|---|---|---|
+| 1 | **High (functional)** | `.github/workflows/ci-ubicloud.yml:79` | Still runs `./scripts/build-wxuniversal-wasm.sh`, which no longer exists on this branch (renamed to `build-wx-wasm.sh`). The CI wxWidgets-build step would fail. The workflow file wasn't updated in the rename commit. (Also stale: a comment at `ci-ubicloud.yml:43` and `scripts/common/stages.sh:7`.) |
+| 2 | **Fixed 2026-06-13** (was real, latent) | `src/wasm/textctrl.cpp` `OnDomEvent` | A throwing `wxEVT_TEXT` handler escaped `OnDomEvent`, leaving `m_inDomInput` wedged `true` and dropping every later programmatic `SetValue`/`ChangeValue` push. Reproduced deterministically (see below). An RAII guard did **not** fix it (destructors don't run during the asyncify+EH unwind); fixed by removing the persistent flag — `OnDomEvent(INPUT)` now calls `wxTextEntry::DoSetValue` directly (updates cache + fires the event, no echo-back push). |
+| 3 | **Fixed 2026-06-13** (was real UAF) | `src/wasm/tooltip.cpp` + `window.cpp` | `gs_hoverWindow` (raw pointer) outlived its window; the 600 ms tooltip timer dereferenced freed memory. Reproduced (see below). Fixed by `wxWasmTooltipForgetWindow()`, called from `~wxWindowWasm`, which clears the pointer and stops the timer — same pattern as the existing `g_mouseWindow`/`gs_focusWindow` nulling. |
+| 4 | Known gap | `src/wasm/window.cpp` (`DoPopupMenu`) | `wxFAIL_MSG("DoPopupMenu not implemented in the DOM port yet")` → context/right-click menus are stubbed (KiCad uses them). Tagged dom-phase-5. |
+| 5 | Known gap | `src/wasm/scrolbar.cpp` | Scrollbar is a no-op stub (wheel-scroll works via `wxWindowWasm::ScrollWindow` moving children, but there is no draggable thumb). Tagged dom-phase-2. |
+
+Minor / TODO-tracked (not bugs): `combobox` `SetSelection` lacks a bounds check;
+`radiobox` per-item enable/show is cached but not reflected to the DOM;
+`checkbox.cpp:95` / `radiobut.cpp:120` read the DOM value in `OnDomEvent` without
+a null-guard (safe in practice — only fired on a live element).
+
+## Bug reproductions and fixes (2026-06-13)
+
+Findings #2 and #3 were turned into deterministic, self-contained
+pure-wxWidgets repros, confirmed RED, then fixed (RED→GREEN). Afterwards the
+full wx e2e suite is **294 passed / 1 skipped / 0 failed** (the 2 new specs
+included — no regression).
+
+- **Repro apps:** `tests/apps/standalone/textctrl-reentry/` and
+  `tests/apps/standalone/tooltip-lifetime/`; spec
+  `tests/e2e/dom-port-bugs.spec.ts`. The textctrl app links with `-fexceptions`
+  (it throws from a handler); the tooltip app uses a small diagnostic accessor
+  `wxWasmTooltipDebugHoverWindow()` kept in `tooltip.cpp`.
+- **textctrl wedge (#2)** is real but **binary-layout-sensitive**: it first
+  passed, then began reproducing 100% after an unrelated rebuild shifted the
+  asyncify/EH function layout (so the throw stopped being contained by
+  `wxEvtHandler::SafelyProcessEvent` before it escaped `OnDomEvent`). The fix
+  removes the persistent `m_inDomInput` flag, so there is nothing left to wedge.
+- **Gotcha worth remembering:** under this build (emscripten **legacy
+  `-fexceptions` + `ASYNCIFY`**), **C++ destructors and `catch` landing pads do
+  not reliably run while an exception unwinds through asyncify-instrumented
+  frames.** RAII/try-catch cleanup that must survive a thrown exception is
+  unreliable here — prefer designs that don't depend on unwind-time cleanup.
+  (This is exactly why the obvious RAII fix for #2 did nothing and the flag had
+  to be eliminated.)
+
+## Leftovers to clean
+
+- **The CI reference (#1)** — the one with real consequence if CI runs.
+- **`docs/features/async/10`** status line still reads *"Full-suite validation
+  across all apps + cleanup + commit pending"* — all of that is done.
+- **`docs/features/wx-dom-port/visual-notes.md`** "Known-red kicad specs
+  (asyncify scope, NOT this feature)" section is likely stale now that the
+  menubar fix turned the kicad suite green.
+- **Vestigial `const appsDir = 'apps'`** (single-use, no effect) in
+  `tests/playwright.config.ts` and `tests/playwright-kicad.config.ts`.
+- **Untracked `.agents/` + `AGENTS.md`** at the repo root — uncommitted and not
+  gitignored (`AGENTS.md` mirrors CLAUDE.md's content; `.agents/skills/` mirrors
+  `.claude/skills/`). They were *not* created by this branch's work.
+
+## Cross-references
+- `docs/features/wx-dom-port/README.md` — the feature overview / fork surface.
+- `docs/features/wx-dom-port/visual-notes.md` — phase-by-phase visual notes.
+- `docs/features/async/10-resolution-menubar-uaf.md` — the menubar UAF fix that
+  closed the DOM-port asyncify-family regression.
diff --git a/tests/apps/Makefile.wasm b/tests/apps/Makefile.wasm
index 5d16dab..a288bda 100644
--- a/tests/apps/Makefile.wasm
+++ b/tests/apps/Makefile.wasm
@@ -180,7 +180,9 @@ all: minimal_test.html \
      $(S)/coroutine-pthread/main_repro.html \
      $(S)/coroutine-pthread/mainloop_repro.html \
      $(S)/coroutine-pthread/nested_repro_ex.html \
-     $(S)/coroutine-pthread/vcall_repro.html
+     $(S)/coroutine-pthread/vcall_repro.html \
+     $(S)/textctrl-reentry/textctrl-reentry_test.html \
+     $(S)/tooltip-lifetime/tooltip-lifetime_test.html
 
 # Main test app
 minimal_test.o: minimal_test.cpp
@@ -189,6 +191,27 @@ minimal_test.o: minimal_test.cpp
 minimal_test.html: minimal_test.o $(WX_CORE_LIB) $(JS_FILES)
 	$(CXX) $< $(LDFLAGS_NOGL) --pre-js $(JS) --shell-file $(HTML) -o $@
 
+# --- DOM-port bug reproductions (docs/features/wx-dom-port/branch-review.md) ---
+
+# wxTextCtrl reentry-guard repro. Needs -fexceptions: it throws from a wxEVT_TEXT
+# handler to prove the OnDomEvent m_inDomInput reset must be exception-safe.
+$(S)/textctrl-reentry/textctrl-reentry_test.o: $(S)/textctrl-reentry/textctrl-reentry_test.cpp
+	$(CXX) -c $(CXXFLAGS) -fexceptions $< -o $@
+
+$(S)/textctrl-reentry/textctrl-reentry_test.html: $(S)/textctrl-reentry/textctrl-reentry_test.o $(WX_CORE_LIB) $(JS_FILES)
+	$(CXX) $< $(LDFLAGS_NOGL) -fexceptions --pre-js $(JS) --shell-file $(HTML) -o $@
+
+textctrl-reentry: $(S)/textctrl-reentry/textctrl-reentry_test.html
+
+# wxToolTip hover-window lifetime repro (relies on wxWasmTooltipDebugHoverWindow).
+$(S)/tooltip-lifetime/tooltip-lifetime_test.o: $(S)/tooltip-lifetime/tooltip-lifetime_test.cpp
+	$(CXX) -c $(CXXFLAGS) $< -o $@
+
+$(S)/tooltip-lifetime/tooltip-lifetime_test.html: $(S)/tooltip-lifetime/tooltip-lifetime_test.o $(WX_CORE_LIB) $(JS_FILES)
+	$(CXX) $< $(LDFLAGS_NOGL) --pre-js $(JS) --shell-file $(HTML) -o $@
+
+tooltip-lifetime: $(S)/tooltip-lifetime/tooltip-lifetime_test.html
+
 # Menu test (no GL)
 $(S)/menu/menu_test.o: $(S)/menu/menu_test.cpp
 	$(CXX) -c $(CXXFLAGS) $< -o $@
diff --git a/tests/apps/standalone/textctrl-reentry/textctrl-reentry_test.cpp b/tests/apps/standalone/textctrl-reentry/textctrl-reentry_test.cpp
new file mode 100644
index 0000000..2fef638
--- /dev/null
+++ b/tests/apps/standalone/textctrl-reentry/textctrl-reentry_test.cpp
@@ -0,0 +1,104 @@
+// wxTextCtrl DOM-sync reentry-guard reproduction (DOM port) — real-path version.
+//
+// Bug (src/wasm/textctrl.cpp, OnDomEvent / wxDOM_EVENT_INPUT):
+//
+//     m_inDomInput = true;
+//     const wxString value = wxDomGetValue(WasmGetDomId());
+//     DoSetValue(value, SetValue_SendEvent);   // fires wxEVT_TEXT
+//     m_inDomInput = false;                     // <-- skipped if a handler throws
+//
+// DoSetValue()/WriteText() only push the value into the <input> element
+// `if (!m_inDomInput)`. If a wxEVT_TEXT handler exits non-locally (throws), the
+// reset is skipped, m_inDomInput stays true, and every later programmatic
+// SetValue()/ChangeValue() silently stops updating the visible element.
+//
+// This repro uses the REAL delivery path (no synthetic OnDomEvent call, no
+// app-level try/catch that could change unwinding): the spec types into the
+// <input>, which fires a genuine DOM 'input' event -> wx-dom.js dispatch() ->
+// wx_dom_event() (extern "C") -> OnDomEvent. The bound wxEVT_TEXT handler throws
+// once; the throw escapes OnDomEvent and is caught by dispatch()'s try/catch at
+// the JS boundary (exactly as a real handler exception would be). The spec then
+// clicks a button that does a programmatic ChangeValue() and checks the element.
+//
+//   RED  (bug present): the <input> keeps the typed text; ChangeValue is dropped.
+//   GREEN (fixed):      the <input> shows the programmatic value.
+
+#include "wx/wxprec.h"
+#ifndef WX_PRECOMP
+    #include "wx/wx.h"
+#endif
+
+#include <stdexcept>
+
+#ifdef __EMSCRIPTEN__
+#include <emscripten/emscripten.h>
+#endif
+
+enum { ID_SET_PROGRAMMATIC = wxID_HIGHEST + 1 };
+
+class ReproFrame : public wxFrame
+{
+public:
+    ReproFrame();
+
+private:
+    void OnText(wxCommandEvent &evt);
+    void OnSetProgrammatic(wxCommandEvent &evt);
+
+    wxTextCtrl *m_text = nullptr;
+    bool m_throwArmed = true;
+};
+
+ReproFrame::ReproFrame()
+    : wxFrame(nullptr, wxID_ANY, "wxTextCtrl reentry repro")
+{
+    wxBoxSizer *sizer = new wxBoxSizer(wxVERTICAL);
+
+    m_text = new wxTextCtrl(this, wxID_ANY, "");
+    m_text->Bind(wxEVT_TEXT, &ReproFrame::OnText, this);
+    sizer->Add(m_text, 0, wxALL, 10);
+
+    wxButton *button = new wxButton(this, ID_SET_PROGRAMMATIC, "Set Programmatic");
+    button->Bind(wxEVT_BUTTON, &ReproFrame::OnSetProgrammatic, this);
+    sizer->Add(button, 0, wxALL, 10);
+
+    SetSizer(sizer);
+
+#ifdef __EMSCRIPTEN__
+    CallAfter([] { EM_ASM({ console.log('[REPRO] textctrl ready'); }); });
+#endif
+}
+
+void ReproFrame::OnText(wxCommandEvent &evt)
+{
+    evt.Skip();
+
+    // A handler that throws (a validator failure, a wxLogError turned into an
+    // exception by a custom log target, ...). Throw once so the app survives.
+    if (m_throwArmed)
+    {
+        m_throwArmed = false;
+        throw std::runtime_error("repro: wxEVT_TEXT handler throws");
+    }
+}
+
+void ReproFrame::OnSetProgrammatic(wxCommandEvent &WXUNUSED(evt))
+{
+    // Must reach the <input> element even after a prior wxEVT_TEXT handler threw.
+    m_text->ChangeValue("PROGRAMMATIC_OK");
+}
+
+class ReproApp : public wxApp
+{
+public:
+    bool OnInit() override
+    {
+        if (!wxApp::OnInit())
+            return false;
+
+        (new ReproFrame())->Show(true);
+        return true;
+    }
+};
+
+wxIMPLEMENT_APP(ReproApp);
diff --git a/tests/apps/standalone/tooltip-lifetime/tooltip-lifetime_test.cpp b/tests/apps/standalone/tooltip-lifetime/tooltip-lifetime_test.cpp
new file mode 100644
index 0000000..f67d10d
--- /dev/null
+++ b/tests/apps/standalone/tooltip-lifetime/tooltip-lifetime_test.cpp
@@ -0,0 +1,105 @@
+// wxToolTip hover-window lifetime reproduction (DOM port).
+//
+// Bug (src/wasm/tooltip.cpp):
+//
+//   wxWindow *gs_hoverWindow = NULL;            // raw pointer, set on hover
+//   ... wxWasmTooltipTimer::Notify() {
+//       wxWindow *win = FindTooltipWindow(gs_hoverWindow);  // 600 ms later:
+//       ...                                                 // win->GetParent()/
+//   }                                                       // GetToolTip()/...
+//
+// Nothing clears gs_hoverWindow when the hovered window is destroyed, so a
+// window destroyed within the 600 ms tooltip delay leaves gs_hoverWindow
+// dangling -> use-after-free when the timer fires.
+//
+// ASAN can't catch this here (the read lives in the wx library, which is not
+// instrumented), so the repro checks the invariant the bug violates directly:
+// it arms the hover for a window (the same call wxApp::HandleMouseEvent makes on
+// hover-in), destroys that window, and asks — via a diagnostic accessor — whether
+// the hovered-window pointer was cleared.
+//
+//   RED  (bug present): gs_hoverWindow still points at the freed window.
+//   GREEN (fixed):      gs_hoverWindow was cleared on destruction.
+
+#include "wx/wxprec.h"
+#ifndef WX_PRECOMP
+    #include "wx/wx.h"
+#endif
+
+#include <cstdint>
+
+#ifdef __EMSCRIPTEN__
+#include <emscripten/emscripten.h>
+#endif
+
+// Hooks defined in src/wasm/tooltip.cpp.
+extern void wxWasmTooltipOnHoverChange(wxWindow *win);
+extern wxWindow *wxWasmTooltipDebugHoverWindow();
+
+static void Report(const char *name, bool pass, const wxString &detail)
+{
+#ifdef __EMSCRIPTEN__
+    EM_ASM({
+        var msg = '[REPRO] ' + UTF8ToString($0) + ': ' + ($1 ? 'PASS' : 'FAIL')
+                  + ' - ' + UTF8ToString($2);
+        if ($1) { console.log(msg); } else { console.error(msg); }
+    }, name, pass ? 1 : 0, (const char *)detail.utf8_str());
+#endif
+}
+
+class ReproFrame : public wxFrame
+{
+public:
+    ReproFrame();
+
+private:
+    void RunTest();
+};
+
+ReproFrame::ReproFrame()
+    : wxFrame(nullptr, wxID_ANY, "wxToolTip lifetime repro")
+{
+    CallAfter(&ReproFrame::RunTest);
+}
+
+void ReproFrame::RunTest()
+{
+    wxWindow *victim = new wxPanel(this, wxID_ANY,
+                                   wxDefaultPosition, wxSize(120, 60));
+    victim->SetToolTip("VICTIM_TOOLTIP");
+
+    // Arm the hover exactly like wxApp::HandleMouseEvent does on hover-in:
+    // gs_hoverWindow = victim, and the 600 ms tooltip timer starts.
+    wxWasmTooltipOnHoverChange(victim);
+    const bool armed = (wxWasmTooltipDebugHoverWindow() == victim);
+
+    const uintptr_t victimAddr = reinterpret_cast<uintptr_t>(victim);
+
+    // Destroy the hovered window while the tooltip timer is still pending.
+    delete victim;
+
+    // Invariant: the hovered-window pointer must not outlive its window.
+    wxWindow *hover = wxWasmTooltipDebugHoverWindow();
+    const bool cleared = (hover == nullptr);
+    const bool pass = armed && cleared;
+
+    Report("tooltip_hover_window_cleared_on_destroy", pass,
+           wxString::Format("armed=%d hover=%p victim=0x%lx",
+                            armed ? 1 : 0, (void *)hover,
+                            static_cast<unsigned long>(victimAddr)));
+}
+
+class ReproApp : public wxApp
+{
+public:
+    bool OnInit() override
+    {
+        if (!wxApp::OnInit())
+            return false;
+
+        (new ReproFrame())->Show(true);
+        return true;
+    }
+};
+
+wxIMPLEMENT_APP(ReproApp);
diff --git a/tests/e2e/dom-port-bugs.spec.ts b/tests/e2e/dom-port-bugs.spec.ts
new file mode 100644
index 0000000..d293eb7
--- /dev/null
+++ b/tests/e2e/dom-port-bugs.spec.ts
@@ -0,0 +1,73 @@
+import { test, expect, tryLoadApp } from './utils/fixtures';
+
+// Red-green reproductions for the two DOM-port bugs in
+// docs/features/wx-dom-port/branch-review.md.
+//
+// Each standalone app (tests/apps/standalone/{textctrl-reentry,tooltip-lifetime})
+// exercises the exact buggy path; the test is RED while the bug is present and
+// GREEN after the wasm-layer fix.
+
+function reproLine(logs: string[], name: string): string | undefined {
+  return logs.find((l) => l.includes(`[REPRO] ${name}:`));
+}
+
+test.describe('wx DOM-port bug reproductions', () => {
+  // textctrl.cpp OnDomEvent(INPUT) sets m_inDomInput=true, fires wxEVT_TEXT, then
+  // resets it — but the reset is skipped if a handler throws, wedging the flag and
+  // silently dropping every later programmatic value push. Driven through the real
+  // path: typing fires a genuine DOM 'input' event whose wxEVT_TEXT handler throws
+  // (caught at wx-dom.js's dispatch() boundary); a button then does a programmatic
+  // ChangeValue() that must still reach the element.
+  test('wxTextCtrl: a throwing wxEVT_TEXT handler must not wedge DOM sync', async ({
+    page,
+    testLogger,
+  }) => {
+    await page.goto('/standalone/textctrl-reentry/textctrl-reentry_test.html');
+    expect(await tryLoadApp(page, 30000), 'repro app should load').toBe(true);
+
+    await expect
+      .poll(() => testLogger.consoleLogs.some((l) => l.includes('[REPRO] textctrl ready')), {
+        timeout: 30000,
+        message: 'repro app should finish setup',
+      })
+      .toBe(true);
+
+    const input = page.locator('input').first();
+    await input.click();
+    await input.pressSequentially('x'); // real DOM 'input' -> wxEVT_TEXT -> throw
+
+    await page.getByRole('button', { name: 'Set Programmatic' }).click(); // ChangeValue
+
+    // The programmatic value must reach the element. RED if the throw wedged
+    // m_inDomInput (the element keeps the typed "x").
+    await expect
+      .poll(async () => await input.inputValue(), {
+        timeout: 10000,
+        message: 'programmatic ChangeValue must reach the <input> after a throwing handler',
+      })
+      .toBe('PROGRAMMATIC_OK');
+  });
+
+  // tooltip.cpp keeps gs_hoverWindow as a raw pointer dereferenced 600ms later by
+  // the tooltip timer; nothing clears it when the window is destroyed, so a window
+  // freed within the delay leaves a dangling pointer (UAF). The app arms the hover,
+  // destroys the window, and self-reports whether the pointer was cleared.
+  test('wxToolTip: the hover-window pointer must not outlive its window', async ({
+    page,
+    testLogger,
+  }) => {
+    const name = 'tooltip_hover_window_cleared_on_destroy';
+    await page.goto('/standalone/tooltip-lifetime/tooltip-lifetime_test.html');
+    expect(await tryLoadApp(page, 30000), 'repro app should load').toBe(true);
+
+    await expect
+      .poll(() => reproLine(testLogger.consoleLogs, name) ?? null, {
+        timeout: 30000,
+        message: `repro app should emit its [REPRO] ${name} result line`,
+      })
+      .not.toBeNull();
+
+    const line = reproLine(testLogger.consoleLogs, name)!;
+    expect(line, `repro line was: ${line}`).toContain(`[REPRO] ${name}: PASS`);
+  });
+});
diff --git a/wxwidgets b/wxwidgets
index d33769a..8814ddb 160000
--- a/wxwidgets
+++ b/wxwidgets
@@ -1 +1 @@
-Subproject commit d33769ab56fde5d8f389c9bd4a58bd08a951a65a
+Subproject commit 8814ddba6c2a2d21e2e1044f87d61ce4b9b17b21