react-native-windows 0.81.20 → 0.81.22

package/Folly/TEMP_UntilFollyUpdate/hash/SpookyHashV2.h

@@ -0,0 +1,334 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// This is version 2 of SpookyHash, incompatible with version 1.
+//
+// SpookyHash: a 128-bit noncryptographic hash function
+// By Bob Jenkins, public domain
+//   Oct 31 2010: alpha, framework + SpookyHash::Mix appears right
+//   Oct 31 2011: alpha again, Mix only good to 2^^69 but rest appears right
+//   Dec 31 2011: beta, improved Mix, tested it for 2-bit deltas
+//   Feb  2 2012: production, same bits as beta
+//   Feb  5 2012: adjusted definitions of uint* to be more portable
+//   Mar 30 2012: 3 bytes/cycle, not 4.  Alpha was 4 but wasn't thorough enough.
+//   August 5 2012: SpookyV2 (different results)
+//
+// Up to 3 bytes/cycle for long messages.  Reasonably fast for short messages.
+// All 1 or 2 bit deltas achieve avalanche within 1% bias per output bit.
+//
+// This was developed for and tested on 64-bit x86-compatible processors.
+// It assumes the processor is little-endian.  There is a macro
+// controlling whether unaligned reads are allowed (by default they are).
+// This should be an equally good hash on big-endian machines, but it will
+// compute different results on them than on little-endian machines.
+//
+// Google's CityHash has similar specs to SpookyHash, and CityHash is faster
+// on new Intel boxes.  MD4 and MD5 also have similar specs, but they are orders
+// of magnitude slower.  CRCs are two or more times slower, but unlike
+// SpookyHash, they have nice math for combining the CRCs of pieces to form
+// the CRCs of wholes.  There are also cryptographic hashes, but those are even
+// slower than MD5.
+//
+
+#pragma once
+
+#include <cassert>
+#include <cstddef>
+#include <cstdint>
+
+#include <folly/CPortability.h>
+#include <folly/Portability.h>
+#include <folly/lang/CString.h>
+
+namespace folly {
+namespace hash {
+
+// clang-format off
+
+class SpookyHashV2
+{
+public:
+    //
+    // SpookyHash: hash a single message in one call, produce 128-bit output
+    //
+    static void Hash128(
+        const void *message,  // message to hash
+        size_t length,        // length of message in bytes
+        uint64_t *hash1,        // in/out: in seed 1, out hash value 1
+        uint64_t *hash2);       // in/out: in seed 2, out hash value 2
+
+    //
+    // Hash64: hash a single message in one call, return 64-bit output
+    //
+    static uint64_t Hash64(
+        const void *message,  // message to hash
+        size_t length,        // length of message in bytes
+        uint64_t seed)          // seed
+    {
+        uint64_t hash1 = seed;
+        Hash128(message, length, &hash1, &seed);
+        return hash1;
+    }
+
+    //
+    // Hash32: hash a single message in one call, produce 32-bit output
+    //
+    static uint32_t Hash32(
+        const void *message,  // message to hash
+        size_t length,        // length of message in bytes
+        uint32_t seed)          // seed
+    {
+        uint64_t hash1 = seed, hash2 = seed;
+        Hash128(message, length, &hash1, &hash2);
+        return (uint32_t)hash1;
+    }
+
+    //
+    // Init: initialize the context of a SpookyHash
+    //
+    void Init(
+        uint64_t seed1,       // any 64-bit value will do, including 0
+        uint64_t seed2);      // different seeds produce independent hashes
+
+    //
+    // Update: add a piece of a message to a SpookyHash state
+    //
+    void Update(
+        const void *message,  // message fragment
+        size_t length);       // length of message fragment in bytes
+
+
+    //
+    // Final: compute the hash for the current SpookyHash state
+    //
+    // This does not modify the state; you can keep updating it afterward
+    //
+    // The result is the same as if SpookyHash() had been called with
+    // all the pieces concatenated into one message.
+    //
+    void Final(
+        uint64_t *hash1,          // out only: first 64 bits of hash value.
+        uint64_t *hash2) const;   // out only: second 64 bits of hash value.
+
+    //
+    // left rotate a 64-bit value by k bytes
+    //
+    static inline uint64_t Rot64(uint64_t x, int k)
+    {
+        return (x << k) | (x >> (64 - k));
+    }
+
+    //
+    // This is used if the input is 96 bytes long or longer.
+    //
+    // The internal state is fully overwritten every 96 bytes.
+    // Every input bit appears to cause at least 128 bits of entropy
+    // before 96 other bytes are combined, when run forward or backward
+    //   For every input bit,
+    //   Two inputs differing in just that input bit
+    //   Where "differ" means xor or subtraction
+    //   And the base value is random
+    //   When run forward or backwards one Mix
+    // I tried 3 pairs of each; they all differed by at least 212 bits.
+    //
+    static inline void Mix(
+        const uint64_t *data,
+        uint64_t &s0, uint64_t &s1, uint64_t &s2, uint64_t &s3,
+        uint64_t &s4, uint64_t &s5, uint64_t &s6, uint64_t &s7,
+        uint64_t &s8, uint64_t &s9, uint64_t &s10,uint64_t &s11)
+    {
+      auto read = [&](auto off) { return Read8(data, off); };
+      s0 += read(0);   s2 ^= s10; s11 ^= s0;  s0 = Rot64(s0,11);   s11 += s1;
+      s1 += read(1);   s3 ^= s11; s0 ^= s1;   s1 = Rot64(s1,32);   s0 += s2;
+      s2 += read(2);   s4 ^= s0;  s1 ^= s2;   s2 = Rot64(s2,43);   s1 += s3;
+      s3 += read(3);   s5 ^= s1;  s2 ^= s3;   s3 = Rot64(s3,31);   s2 += s4;
+      s4 += read(4);   s6 ^= s2;  s3 ^= s4;   s4 = Rot64(s4,17);   s3 += s5;
+      s5 += read(5);   s7 ^= s3;  s4 ^= s5;   s5 = Rot64(s5,28);   s4 += s6;
+      s6 += read(6);   s8 ^= s4;  s5 ^= s6;   s6 = Rot64(s6,39);   s5 += s7;
+      s7 += read(7);   s9 ^= s5;  s6 ^= s7;   s7 = Rot64(s7,57);   s6 += s8;
+      s8 += read(8);   s10 ^= s6; s7 ^= s8;   s8 = Rot64(s8,55);   s7 += s9;
+      s9 += read(9);   s11 ^= s7; s8 ^= s9;   s9 = Rot64(s9,54);   s8 += s10;
+      s10 += read(10); s0 ^= s8;  s9 ^= s10;  s10 = Rot64(s10,22); s9 += s11;
+      s11 += read(11); s1 ^= s9;  s10 ^= s11; s11 = Rot64(s11,46); s10 += s0;
+    }
+
+    //
+    // Mix all 12 inputs together so that h0, h1 are a hash of them all.
+    //
+    // For two inputs differing in just the input bits
+    // Where "differ" means xor or subtraction
+    // And the base value is random, or a counting value starting at that bit
+    // The final result will have each bit of h0, h1 flip
+    // For every input bit,
+    // with probability 50 +- .3%
+    // For every pair of input bits,
+    // with probability 50 +- 3%
+    //
+    // This does not rely on the last Mix() call having already mixed some.
+    // Two iterations was almost good enough for a 64-bit result, but a
+    // 128-bit result is reported, so End() does three iterations.
+    //
+    static inline void EndPartial(
+        uint64_t &h0, uint64_t &h1, uint64_t &h2, uint64_t &h3,
+        uint64_t &h4, uint64_t &h5, uint64_t &h6, uint64_t &h7,
+        uint64_t &h8, uint64_t &h9, uint64_t &h10,uint64_t &h11)
+    {
+        h11+= h1;    h2 ^= h11;   h1 = Rot64(h1,44);
+        h0 += h2;    h3 ^= h0;    h2 = Rot64(h2,15);
+        h1 += h3;    h4 ^= h1;    h3 = Rot64(h3,34);
+        h2 += h4;    h5 ^= h2;    h4 = Rot64(h4,21);
+        h3 += h5;    h6 ^= h3;    h5 = Rot64(h5,38);
+        h4 += h6;    h7 ^= h4;    h6 = Rot64(h6,33);
+        h5 += h7;    h8 ^= h5;    h7 = Rot64(h7,10);
+        h6 += h8;    h9 ^= h6;    h8 = Rot64(h8,13);
+        h7 += h9;    h10^= h7;    h9 = Rot64(h9,38);
+        h8 += h10;   h11^= h8;    h10= Rot64(h10,53);
+        h9 += h11;   h0 ^= h9;    h11= Rot64(h11,42);
+        h10+= h0;    h1 ^= h10;   h0 = Rot64(h0,54);
+    }
+
+    static inline void End(
+        const uint64_t *data,
+        uint64_t &h0, uint64_t &h1, uint64_t &h2, uint64_t &h3,
+        uint64_t &h4, uint64_t &h5, uint64_t &h6, uint64_t &h7,
+        uint64_t &h8, uint64_t &h9, uint64_t &h10,uint64_t &h11)
+    {
+        h0 += data[0];   h1 += data[1];   h2 += data[2];   h3 += data[3];
+        h4 += data[4];   h5 += data[5];   h6 += data[6];   h7 += data[7];
+        h8 += data[8];   h9 += data[9];   h10 += data[10]; h11 += data[11];
+        EndPartial(h0,h1,h2,h3,h4,h5,h6,h7,h8,h9,h10,h11);
+        EndPartial(h0,h1,h2,h3,h4,h5,h6,h7,h8,h9,h10,h11);
+        EndPartial(h0,h1,h2,h3,h4,h5,h6,h7,h8,h9,h10,h11);
+    }
+
+    //
+    // The goal is for each bit of the input to expand into 128 bits of
+    //   apparent entropy before it is fully overwritten.
+    // n trials both set and cleared at least m bits of h0 h1 h2 h3
+    //   n: 2   m: 29
+    //   n: 3   m: 46
+    //   n: 4   m: 57
+    //   n: 5   m: 107
+    //   n: 6   m: 146
+    //   n: 7   m: 152
+    // when run forwards or backwards
+    // for all 1-bit and 2-bit diffs
+    // with diffs defined by either xor or subtraction
+    // with a base of all zeros plus a counter, or plus another bit, or random
+    //
+    static inline void ShortMix(uint64_t &h0, uint64_t &h1,
+                                uint64_t &h2, uint64_t &h3)
+    {
+        h2 = Rot64(h2,50);  h2 += h3;  h0 ^= h2;
+        h3 = Rot64(h3,52);  h3 += h0;  h1 ^= h3;
+        h0 = Rot64(h0,30);  h0 += h1;  h2 ^= h0;
+        h1 = Rot64(h1,41);  h1 += h2;  h3 ^= h1;
+        h2 = Rot64(h2,54);  h2 += h3;  h0 ^= h2;
+        h3 = Rot64(h3,48);  h3 += h0;  h1 ^= h3;
+        h0 = Rot64(h0,38);  h0 += h1;  h2 ^= h0;
+        h1 = Rot64(h1,37);  h1 += h2;  h3 ^= h1;
+        h2 = Rot64(h2,62);  h2 += h3;  h0 ^= h2;
+        h3 = Rot64(h3,34);  h3 += h0;  h1 ^= h3;
+        h0 = Rot64(h0,5);   h0 += h1;  h2 ^= h0;
+        h1 = Rot64(h1,36);  h1 += h2;  h3 ^= h1;
+    }
+
+    //
+    // Mix all 4 inputs together so that h0, h1 are a hash of them all.
+    //
+    // For two inputs differing in just the input bits
+    // Where "differ" means xor or subtraction
+    // And the base value is random, or a counting value starting at that bit
+    // The final result will have each bit of h0, h1 flip
+    // For every input bit,
+    // with probability 50 +- .3% (it is probably better than that)
+    // For every pair of input bits,
+    // with probability 50 +- .75% (the worst case is approximately that)
+    //
+    static inline void ShortEnd(uint64_t &h0, uint64_t &h1,
+                                uint64_t &h2, uint64_t &h3)
+    {
+        h3 ^= h2;  h2 = Rot64(h2,15);  h3 += h2;
+        h0 ^= h3;  h3 = Rot64(h3,52);  h0 += h3;
+        h1 ^= h0;  h0 = Rot64(h0,26);  h1 += h0;
+        h2 ^= h1;  h1 = Rot64(h1,51);  h2 += h1;
+        h3 ^= h2;  h2 = Rot64(h2,28);  h3 += h2;
+        h0 ^= h3;  h3 = Rot64(h3,9);   h0 += h3;
+        h1 ^= h0;  h0 = Rot64(h0,47);  h1 += h0;
+        h2 ^= h1;  h1 = Rot64(h1,54);  h2 += h1;
+        h3 ^= h2;  h2 = Rot64(h2,32);  h3 += h2;
+        h0 ^= h3;  h3 = Rot64(h3,25);  h0 += h3;
+        h1 ^= h0;  h0 = Rot64(h0,63);  h1 += h0;
+    }
+
+private:
+
+    //
+    // Short is used for messages under 192 bytes in length
+    // Short has a low startup cost, the normal mode is good for long
+    // keys, the cost crossover is at about 192 bytes.  The two modes were
+    // held to the same quality bar.
+    //
+    static void Short(
+        const void *message,  // message (byte array, not necessarily aligned)
+        size_t length,        // length of message (in bytes)
+        uint64_t *hash1,        // in/out: in the seed, out the hash value
+        uint64_t *hash2);       // in/out: in the seed, out the hash value
+
+    //
+    // Helper to read 8 consecutive bytes from a buffer
+    // If the platform has unaligned access, may be called with unaligned buf
+    // Otherwise, must be called only with aligned buf
+    //
+    FOLLY_ALWAYS_INLINE static uint64_t Read8(const uint64_t* buf, size_t off) {
+      if constexpr (kHasUnalignedAccess) {
+        uint64_t out;
+        FOLLY_BUILTIN_MEMCPY(&out, buf + off, sizeof(out));
+        return out;
+      } else {
+        //assert(0 == reinterpret_cast<uintptr_t>(buf) % sizeof(*buf)); // Windows
+        return buf[off];
+      }
+    }
+
+    // number of uint64_t's in internal state
+    static constexpr size_t sc_numVars = 12;
+
+    // size of the internal state
+    static constexpr size_t sc_blockSize = sc_numVars*8;
+
+    // size of buffer of unhashed data, in bytes
+    static constexpr size_t sc_bufSize = 2*sc_blockSize;
+
+    //
+    // sc_const: a constant which:
+    //  * is not zero
+    //  * is odd
+    //  * is a not-very-regular mix of 1's and 0's
+    //  * does not need any other special mathematical properties
+    //
+    static constexpr uint64_t sc_const = 0xdeadbeefdeadbeefULL;
+
+    uint64_t m_data[2*sc_numVars];   // unhashed data, for partial messages
+    uint64_t m_state[sc_numVars];  // internal state of the hash
+    size_t m_length;             // total length of the input so far
+    uint8_t  m_remainder;          // length of unhashed data stashed in m_data
+};
+
+// clang-format on
+
+} // namespace hash
+} // namespace folly

package/Microsoft.ReactNative/Fabric/Composition/CompositionEventHandler.cpp

@@ -227,6 +227,28 @@ void CompositionEventHandler::Initialize() noexcept {
           }
         });
 
+    // Issue #16047: when ScrollView calls VisualInteractionSource::TryRedirectForManipulation
+    // and the OS hands the pointer over to the InteractionTracker, WinAppSDK
+    // does not fire PointerCaptureLost on this source — but it does fire
+    // PointerRoutedAway. Treat it the same way as captureloss: cancel any
+    // active touch RN is tracking for this pointer so Pressables don't get
+    // stuck in their pressed state.
+    m_pointerRoutedAwayToken =
+        pointerSource.PointerRoutedAway([wkThis = weak_from_this()](
+                                            winrt::Microsoft::UI::Input::InputPointerSource const &,
+                                            winrt::Microsoft::UI::Input::PointerEventArgs const &args) {
+          if (auto strongThis = wkThis.lock()) {
+            if (auto strongRootView = strongThis->m_wkRootView.get()) {
+              if (strongThis->SurfaceId() == -1)
+                return;
+
+              auto pp = winrt::make<winrt::Microsoft::ReactNative::Composition::Input::implementation::PointerPoint>(
+                  args.CurrentPoint(), strongRootView.ScaleFactor());
+              strongThis->onPointerRoutedAway(pp, args.KeyModifiers());
+            }
+          }
+        });
+
     m_pointerWheelChangedToken =
         pointerSource.PointerWheelChanged([wkThis = weak_from_this()](
                                               winrt::Microsoft::UI::Input::InputPointerSource const &,
@@ -374,6 +396,7 @@ CompositionEventHandler::~CompositionEventHandler() {
       pointerSource.PointerReleased(m_pointerReleasedToken);
       pointerSource.PointerMoved(m_pointerMovedToken);
       pointerSource.PointerCaptureLost(m_pointerCaptureLostToken);
+      pointerSource.PointerRoutedAway(m_pointerRoutedAwayToken);
       pointerSource.PointerWheelChanged(m_pointerWheelChangedToken);
       pointerSource.PointerExited(m_pointerExitedToken);
       auto keyboardSource = winrt::Microsoft::UI::Input::InputKeyboardSource::GetForIsland(island);
@@ -1123,24 +1146,49 @@ void CompositionEventHandler::onPointerCaptureLost(
     m_pointerCapturingComponentTag = -1;
   }
 
-  // Also cancel any active touch for the specific pointer that lost capture, even
-  // when no JS-level CapturePointer was ever issued. This handles ScrollView (and
-  // any other VisualInteractionSource) calling TryRedirectForManipulation: the OS
-  // reassigns the pointer to the InteractionTracker, fires PointerCaptureLost, and
-  // then stops delivering PointerMoved/PointerReleased to us. Without this cleanup
-  // m_activeTouches keeps a zombie entry whose target is the originally-pressed
-  // Pressable, leaving it visually pressed and causing later taps to be attributed
-  // to that original target. If the entry was already cleared above (for a JS-level
-  // capture) or by onPointerReleased running first, the find() is a no-op.
-  PointerId pointerId = pointerPoint.PointerId();
+  // Defense-in-depth cleanup for the specific pointer that lost capture, even
+  // when no JS-level CapturePointer was ever issued. The ScrollView
+  // TryRedirectForManipulation path comes in via PointerRoutedAway, not
+  // PointerCaptureLost (see onPointerRoutedAway and issue #16047), so this
+  // path covers the remaining system-driven losses (focus change, another
+  // window stealing input, system back gesture, etc.).
+  CancelActiveTouchForPointerInternal(pointerPoint.PointerId(), pointerPoint, keyModifiers);
+}
+
+void CompositionEventHandler::onPointerRoutedAway(
+    const winrt::Microsoft::ReactNative::Composition::Input::PointerPoint &pointerPoint,
+    winrt::Windows::System::VirtualKeyModifiers keyModifiers) noexcept {
+  if (SurfaceId() == -1)
+    return;
+
+  // Issue #16047: WinAppSDK fires PointerRoutedAway when the OS hands the
+  // pointer to another InputPointerSource — most importantly for us, when
+  // ScrollView calls VisualInteractionSource::TryRedirectForManipulation and
+  // the InteractionTracker takes the gesture for scrolling. We never get
+  // PointerMoved / PointerReleased / PointerCaptureLost for that pointer
+  // afterwards, so without this cleanup m_activeTouches keeps a zombie entry
+  // and the originally-pressed Pressable stays stuck in its pressed state.
+  CancelActiveTouchForPointerInternal(pointerPoint.PointerId(), pointerPoint, keyModifiers);
+}
+
+bool CompositionEventHandler::CancelActiveTouchForPointerInternal(
+    PointerId pointerId,
+    const winrt::Microsoft::ReactNative::Composition::Input::PointerPoint &pointerPoint,
+    winrt::Windows::System::VirtualKeyModifiers keyModifiers) noexcept {
   auto activeTouch = m_activeTouches.find(pointerId);
-  if (activeTouch != m_activeTouches.end()) {
-    ActiveTouch cancelledTouchCopy = std::move(activeTouch->second);
-    m_activeTouches.erase(activeTouch);
-    if (cancelledTouchCopy.eventEmitter) {
-      DispatchSynthesizedTouchCancelForActiveTouch(cancelledTouchCopy, pointerPoint, keyModifiers);
-    }
+  if (activeTouch == m_activeTouches.end()) {
+    return false;
+  }
+
+  ActiveTouch cancelledTouchCopy = std::move(activeTouch->second);
+  m_activeTouches.erase(activeTouch);
+
+  if (!cancelledTouchCopy.eventEmitter) {
+    return false;
   }
+
+  DispatchSynthesizedTouchCancelForActiveTouch(cancelledTouchCopy, pointerPoint, keyModifiers);
+  return true;
 }
 
 void CompositionEventHandler::onPointerMoved(

package/Microsoft.ReactNative/Fabric/Composition/CompositionEventHandler.h

@@ -66,6 +66,9 @@ class CompositionEventHandler : public std::enable_shared_from_this<CompositionE
   void onPointerCaptureLost(
       const winrt::Microsoft::ReactNative::Composition::Input::PointerPoint &pointerPoint,
       winrt::Windows::System::VirtualKeyModifiers keyModifiers) noexcept;
+  void onPointerRoutedAway(
+      const winrt::Microsoft::ReactNative::Composition::Input::PointerPoint &pointerPoint,
+      winrt::Windows::System::VirtualKeyModifiers keyModifiers) noexcept;
   void onKeyDown(const winrt::Microsoft::ReactNative::Composition::Input::KeyRoutedEventArgs &args) noexcept;
   void onKeyUp(const winrt::Microsoft::ReactNative::Composition::Input::KeyRoutedEventArgs &args) noexcept;
   void onCharacterReceived(
@@ -156,6 +159,13 @@ class CompositionEventHandler : public std::enable_shared_from_this<CompositionE
       const winrt::Microsoft::ReactNative::Composition::Input::PointerPoint &pointerPoint,
       winrt::Windows::System::VirtualKeyModifiers keyModifiers);
 
+  // Look up the active touch for pointerId, erase it, and dispatch cancel events.
+  // Returns true iff a touch was found and cancel events were dispatched.
+  bool CancelActiveTouchForPointerInternal(
+      PointerId pointerId,
+      const winrt::Microsoft::ReactNative::Composition::Input::PointerPoint &pointerPoint,
+      winrt::Windows::System::VirtualKeyModifiers keyModifiers) noexcept;
+
   std::vector<winrt::Microsoft::ReactNative::ComponentView> GetTouchableViewsInPathToRoot(
       const winrt::Microsoft::ReactNative::ComponentView &componentView);
 
@@ -187,6 +197,7 @@ class CompositionEventHandler : public std::enable_shared_from_this<CompositionE
   winrt::event_token m_pointerMovedToken;
   winrt::event_token m_pointerWheelChangedToken;
   winrt::event_token m_pointerCaptureLostToken;
+  winrt::event_token m_pointerRoutedAwayToken;
   winrt::event_token m_pointerExitedToken;
   winrt::event_token m_keyDownToken;
   winrt::event_token m_keyUpToken;

package/Microsoft.ReactNative/Fabric/Composition/ScrollViewComponentView.cpp

@@ -23,6 +23,7 @@
 #include <functional>
 #include "ContentIslandComponentView.h"
 #include "JSValueReader.h"
+#include "ReactNativeIsland.h"
 #include "RootComponentView.h"
 
 namespace winrt::Microsoft::ReactNative::Composition::implementation {
@@ -849,13 +850,27 @@ void ScrollViewComponentView::updateStateWithContentOffset() noexcept {
     return;
   }
 
-  auto scrollPosition = m_scrollVisual.ScrollPosition();
-  m_verticalScrollbarComponent->ContentOffset(scrollPosition);
-  m_horizontalScrollbarComponent->ContentOffset(scrollPosition);
-
-  m_state->updateState([scrollPosition](const facebook::react::ScrollViewShadowNode::ConcreteState::Data &data) {
+  // Issue #16047: m_scrollVisual.ScrollPosition() returns the InteractionTracker
+  // position in PHYSICAL pixels (the visual is sized as
+  // layoutMetrics.frame.size.* * pointScaleFactor — see updateLayoutMetrics /
+  // updateContentVisualSize) but ScrollViewShadowNode state's contentOffset is
+  // in DIPs. Without the conversion, JS UIManager.measure() over-subtracts by
+  // pointScaleFactor on non-100% display scales, leaving Pressables inside a
+  // scrolled ScrollView with stale page-space bounds that don't contain the
+  // touch — Pressability fires LEAVE_PRESS_RECT inside pressIn and suppresses
+  // press. The JS-event-emitter paths in this file (see lines using
+  // args.Position() / pointScaleFactor) already do this division.
+  auto rawScrollPosition = m_scrollVisual.ScrollPosition();
+  const float pointScaleFactor = m_layoutMetrics.pointScaleFactor > 0.0f ? m_layoutMetrics.pointScaleFactor : 1.0f;
+  facebook::react::Point contentOffsetDips{
+      rawScrollPosition.x / pointScaleFactor, rawScrollPosition.y / pointScaleFactor};
+
+  m_verticalScrollbarComponent->ContentOffset(rawScrollPosition);
+  m_horizontalScrollbarComponent->ContentOffset(rawScrollPosition);
+
+  m_state->updateState([contentOffsetDips](const facebook::react::ScrollViewShadowNode::ConcreteState::Data &data) {
     auto newData = data;
-    newData.contentOffset = {scrollPosition.x, scrollPosition.y};
+    newData.contentOffset = contentOffsetDips;
     return std::make_shared<facebook::react::ScrollViewShadowNode::ConcreteState::Data const>(newData);
   });
 }
@@ -1389,6 +1404,13 @@ winrt::Microsoft::ReactNative::Composition::Experimental::IVisual ScrollViewComp
       [this](
           winrt::IInspectable const & /*sender*/,
           winrt::Microsoft::ReactNative::Composition::Experimental::IScrollPositionChangedArgs const &args) {
+        // Issue #16047: push the FINAL settled scroll position into Fabric's
+        // shadow tree before notifying JS. The per-frame ScrollPositionChanged
+        // updates can drop the last inertia delta, leaving contentOffset stale
+        // and JS UIManager.measure() returning pre-settle-relative bounds.
+        // ScrollEndDrag / ScrollBeginDrag already call this; momentum-end was
+        // the missing completion path.
+        updateStateWithContentOffset();
         auto eventEmitter = GetEventEmitter();
         if (eventEmitter) {
           auto scrollMetrics = getScrollMetrics(eventEmitter, args);

package/Microsoft.ReactNative/Fabric/Composition/TooltipService.cpp

@@ -169,12 +169,22 @@ TooltipTracker::TooltipTracker(
   view.PointerEntered({this, &TooltipTracker::OnPointerEntered});
   view.PointerExited({this, &TooltipTracker::OnPointerExited});
   view.PointerMoved({this, &TooltipTracker::OnPointerMoved});
+  view.GotFocus({this, &TooltipTracker::OnGotFocus});
+  view.LostFocus({this, &TooltipTracker::OnLostFocus});
   view.Unmounted({this, &TooltipTracker::OnUnmounted});
 }
 
 TooltipTracker::~TooltipTracker() {
   DestroyTimer();
   DestroyTooltip();
+  m_outer->NotifyDismiss(this);
+}
+
+void TooltipTracker::DismissForExternalRequest() noexcept {
+  // Service is already updating its active slot; do not call back into it.
+  m_focusTooltip = false;
+  DestroyTimer();
+  DestroyTooltip();
 }
 
 facebook::react::Tag TooltipTracker::Tag() const noexcept {
@@ -192,6 +202,9 @@ void TooltipTracker::OnPointerEntered(
   auto pp = args.GetCurrentPoint(-1);
   m_pos = pp.Position();
 
+  // Claim the single tooltip slot, dismissing any other tracker's pending or visible tooltip.
+  m_outer->NotifyShow(this);
+
   m_timer = winrt::Microsoft::ReactNative::Timer::Create(m_properties.Handle());
   m_timer.Interval(std::chrono::milliseconds(toolTipTimeToShowMs));
   m_timer.Tick({this, &TooltipTracker::OnTick});
@@ -225,6 +238,56 @@ void TooltipTracker::OnPointerExited(
     return;
   DestroyTimer();
   DestroyTooltip();
+  m_outer->NotifyDismiss(this);
+}
+
+void TooltipTracker::OnGotFocus(
+    const winrt::Windows::Foundation::IInspectable & /*sender*/,
+    const winrt::Microsoft::ReactNative::Composition::Input::RoutedEventArgs & /*args*/) noexcept {
+  // Skip if a mouse-driven tooltip or its dwell timer is already in flight on this view.
+  if (m_hwndTip || m_timer) {
+    return;
+  }
+
+  auto view = m_view.view();
+  if (!view) {
+    return;
+  }
+
+  auto viewCompView = view.try_as<winrt::Microsoft::ReactNative::Composition::ViewComponentView>();
+  if (!viewCompView) {
+    return;
+  }
+  auto selfView =
+      winrt::get_self<winrt::Microsoft::ReactNative::Composition::implementation::ViewComponentView>(viewCompView);
+  RECT rc = selfView->getClientRect();
+  auto scaleFactor = view.LayoutMetrics().PointScaleFactor;
+  if (scaleFactor <= 0) {
+    return;
+  }
+
+  // Anchor in DIPs at the horizontal center of the view's top edge; ShowTooltip re-applies scaleFactor.
+  m_pos = {static_cast<float>(rc.left + rc.right) / 2.0f / scaleFactor, static_cast<float>(rc.top) / scaleFactor};
+
+  m_focusTooltip = true;
+  // Claim the single tooltip slot, dismissing any other tracker's pending or visible tooltip.
+  m_outer->NotifyShow(this);
+  m_timer = winrt::Microsoft::ReactNative::Timer::Create(m_properties.Handle());
+  m_timer.Interval(std::chrono::milliseconds(toolTipTimeToShowMs));
+  m_timer.Tick({this, &TooltipTracker::OnTick});
+  m_timer.Start();
+}
+
+void TooltipTracker::OnLostFocus(
+    const winrt::Windows::Foundation::IInspectable & /*sender*/,
+    const winrt::Microsoft::ReactNative::Composition::Input::RoutedEventArgs & /*args*/) noexcept {
+  if (!m_focusTooltip) {
+    return;
+  }
+  m_focusTooltip = false;
+  DestroyTimer();
+  DestroyTooltip();
+  m_outer->NotifyDismiss(this);
 }
 
 void TooltipTracker::OnUnmounted(
@@ -232,6 +295,7 @@ void TooltipTracker::OnUnmounted(
     const winrt::Microsoft::ReactNative::ComponentView &) noexcept {
   DestroyTimer();
   DestroyTooltip();
+  m_outer->NotifyDismiss(this);
 }
 
 void TooltipTracker::ShowTooltip(const winrt::Microsoft::ReactNative::ComponentView &view) noexcept {
@@ -326,6 +390,22 @@ void TooltipService::StopTracking(const winrt::Microsoft::ReactNative::Component
   }
 }
 
+void TooltipService::NotifyShow(TooltipTracker *tracker) noexcept {
+  if (m_activeTracker == tracker) {
+    return;
+  }
+  if (m_activeTracker) {
+    m_activeTracker->DismissForExternalRequest();
+  }
+  m_activeTracker = tracker;
+}
+
+void TooltipService::NotifyDismiss(TooltipTracker *tracker) noexcept {
+  if (m_activeTracker == tracker) {
+    m_activeTracker = nullptr;
+  }
+}
+
 static const ReactPropertyId<winrt::Microsoft::ReactNative::ReactNonAbiValue<std::shared_ptr<TooltipService>>>
     &TooltipServicePropertyId() noexcept {
   static const ReactPropertyId<winrt::Microsoft::ReactNative::ReactNonAbiValue<std::shared_ptr<TooltipService>>> prop{

package/Microsoft.ReactNative/Fabric/Composition/TooltipService.h

@@ -27,6 +27,12 @@ struct TooltipTracker {
   void OnPointerExited(
       const winrt::Windows::Foundation::IInspectable &sender,
       const winrt::Microsoft::ReactNative::Composition::Input::PointerRoutedEventArgs &args) noexcept;
+  void OnGotFocus(
+      const winrt::Windows::Foundation::IInspectable &sender,
+      const winrt::Microsoft::ReactNative::Composition::Input::RoutedEventArgs &args) noexcept;
+  void OnLostFocus(
+      const winrt::Windows::Foundation::IInspectable &sender,
+      const winrt::Microsoft::ReactNative::Composition::Input::RoutedEventArgs &args) noexcept;
   void OnTick(
       const winrt::Windows::Foundation::IInspectable &,
       const winrt::Windows::Foundation::IInspectable &) noexcept;
@@ -36,6 +42,10 @@ struct TooltipTracker {
 
   facebook::react::Tag Tag() const noexcept;
 
+  // Cancel pending dwell timer and close any visible tooltip popup; used by the service when another tracker takes
+  // over.
+  void DismissForExternalRequest() noexcept;
+
  private:
   void ShowTooltip(const winrt::Microsoft::ReactNative::ComponentView &view) noexcept;
   void DestroyTimer() noexcept;
@@ -46,6 +56,7 @@ struct TooltipTracker {
   ::Microsoft::ReactNative::ReactTaggedView m_view;
   winrt::Microsoft::ReactNative::ITimer m_timer;
   HWND m_hwndTip{nullptr};
+  bool m_focusTooltip{false};
   winrt::Microsoft::ReactNative::ReactPropertyBag m_properties;
 };
 
@@ -54,12 +65,18 @@ struct TooltipService {
   void StartTracking(const winrt::Microsoft::ReactNative::ComponentView &view) noexcept;
   void StopTracking(const winrt::Microsoft::ReactNative::ComponentView &view) noexcept;
 
+  // Enforce "only one tooltip visible at a time": dismisses the previously active tracker, if any.
+  void NotifyShow(TooltipTracker *tracker) noexcept;
+  // Clears the active-tracker slot if it still points at `tracker`.
+  void NotifyDismiss(TooltipTracker *tracker) noexcept;
+
   static std::shared_ptr<TooltipService> GetCurrent(
       const winrt::Microsoft::ReactNative::ReactPropertyBag &properties) noexcept;
 
  private:
   std::vector<std::shared_ptr<TooltipTracker>> m_enteredTrackers;
   std::vector<std::shared_ptr<TooltipTracker>> m_trackers;
+  TooltipTracker *m_activeTracker{nullptr};
   winrt::Microsoft::ReactNative::ReactPropertyBag m_properties;
 };
 

package/PropertySheets/Generated/PackageVersion.g.props

@@ -10,11 +10,11 @@
 -->
 <Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <PropertyGroup>
-    <ReactNativeWindowsVersion>0.81.20</ReactNativeWindowsVersion>
+    <ReactNativeWindowsVersion>0.81.22</ReactNativeWindowsVersion>
     <ReactNativeWindowsMajor>0</ReactNativeWindowsMajor>
     <ReactNativeWindowsMinor>81</ReactNativeWindowsMinor>
-    <ReactNativeWindowsPatch>20</ReactNativeWindowsPatch>
+    <ReactNativeWindowsPatch>22</ReactNativeWindowsPatch>
     <ReactNativeWindowsCanary>false</ReactNativeWindowsCanary>
-    <ReactNativeWindowsCommitId>29ff929a448c74d7ab0362c6ef8bde4313d31b47</ReactNativeWindowsCommitId>
+    <ReactNativeWindowsCommitId>aaa05f5c3491ec4f2d62cb630b7ae51cd6a0f750</ReactNativeWindowsCommitId>
   </PropertyGroup>
 </Project>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-windows",
-  "version": "0.81.20",
+  "version": "0.81.22",
   "license": "MIT",
   "repository": {
     "type": "git",

package/template/cpp-lib/proj/MyLib.vcxproj

@@ -15,6 +15,7 @@
     <ApplicationType>Windows Store</ApplicationType>
     <ApplicationTypeRevision>10.0</ApplicationTypeRevision>
   </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Label="ReactNativeWindowsProps">
     <ReactNativeWindowsDir Condition="'$(ReactNativeWindowsDir)' == ''">$([MSBuild]::GetDirectoryNameOfFileAbove($(SolutionDir), 'node_modules\react-native-windows\package.json'))\node_modules\react-native-windows\</ReactNativeWindowsDir>
   </PropertyGroup>
@@ -23,7 +24,6 @@
     <WindowsTargetPlatformVersion Condition=" '$(WindowsTargetPlatformVersion)' == '' ">10.0.22621.0</WindowsTargetPlatformVersion>
     <WindowsTargetPlatformMinVersion Condition=" '$(WindowsTargetPlatformMinVersion)' == '' ">10.0.17763.0</WindowsTargetPlatformMinVersion>
   </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|ARM64">
       <Configuration>Debug</Configuration>

package/templates/cpp-app/windows/MyApp/MyApp.vcxproj

@@ -16,11 +16,11 @@
     <MinimumVisualStudioVersion>17.0</MinimumVisualStudioVersion>
     <AppxPackage>false</AppxPackage>
   </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Label="ReactNativeWindowsProps">
     <ReactNativeWindowsDir Condition="'$(ReactNativeWindowsDir)' == ''">$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildThisFileDirectory), 'node_modules\react-native-windows\package.json'))\node_modules\react-native-windows\</ReactNativeWindowsDir>
   </PropertyGroup>
   <Import Project="$(ReactNativeWindowsDir)\PropertySheets\External\Microsoft.ReactNative.WindowsSdk.Default.props" />
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
       <Configuration>Debug</Configuration>

package/templates/cpp-lib/windows/MyLib/MyLib.vcxproj

@@ -14,12 +14,12 @@
     <MinimumVisualStudioVersion>17.0</MinimumVisualStudioVersion>
     <AppxPackage>false</AppxPackage>
   </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Label="ReactNativeWindowsProps">
     <ReactNativeWindowsDir Condition="'$(ReactNativeWindowsDir)' == ''">$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildThisFileDirectory), 'node_modules\react-native-windows\package.json'))\node_modules\react-native-windows\</ReactNativeWindowsDir>
     <RunAutolinkCheck>false</RunAutolinkCheck>
   </PropertyGroup>
   <Import Project="$(ReactNativeWindowsDir)\PropertySheets\External\Microsoft.ReactNative.WindowsSdk.Default.props" />
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
       <Configuration>Debug</Configuration>