The initial hit testing which happens outside child processes can be a bit tricky. When an event is got from the OS, it needs to be sent to the right child process (not through topmost child process, since that would leak information and be probably too slow). Perhaps in the simple, and the most common case where iframes are rectangular, Browsing Context Tree could have information about the size and position of the iframes and scroll information could be get from APZ or so.
More complicated case is if iframes are transformed.

Tentatively moving all bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to the "?" triage milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732

Blocks enabling Fission in Nightly (M6)

The remaining work is being tracked as part of apz-fission-hit-test meta bug. So closing this one now.