Broadcast frame tree updates when a frame is removed as well as added

https://bugs.webkit.org/show_bug.cgi?id=259456 rdar://112800063 Reviewed by Ryosuke Niwa. When a frame is created when site isolation is enabled, all the other web content processes need to create a RemoteFrame in that place in the frame tree indicating that a LocalFrame exists in another process. This has already been implemented. In this PR, I implement the complement: when a frame is destroyed, all the other web content processes need to remove the Frame in that place in their own frame trees. * Source/WebCore/html/HTMLFrameOwnerElement.cpp: (WebCore::HTMLFrameOwnerElement::disconnectContentFrame): * Source/WebCore/loader/EmptyFrameLoaderClient.h: * Source/WebCore/loader/LocalFrameLoaderClient.h: * Source/WebCore/page/Frame.h: * Source/WebCore/page/LocalFrame.cpp: (WebCore::LocalFrame::broadcastFrameRemovalToOtherProcesses): * Source/WebCore/page/LocalFrame.h: * Source/WebCore/page/RemoteFrame.cpp: (WebCore::RemoteFrame::broadcastFrameRemovalToOtherProcesses): * Source/WebCore/page/RemoteFrame.h: * Source/WebCore/page/RemoteFrameClient.h: * Source/WebKit/UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::forEachWebContentProcess): (WebKit::WebPageProxy::createRemoteSubframesInOtherProcesses): (WebKit::WebPageProxy::broadcastFrameRemovalToOtherProcesses): * Source/WebKit/UIProcess/WebPageProxy.h: * Source/WebKit/UIProcess/WebPageProxy.messages.in: * Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp: (WebKit::WebFrameLoaderClient::broadcastFrameRemovalToOtherProcesses): * Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h: * Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp: (WebKit::WebLocalFrameLoaderClient::broadcastFrameRemovalToOtherProcesses): * Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.h: * Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp: (WebKit::WebRemoteFrameClient::broadcastFrameRemovalToOtherProcesses): * Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.h: * Source/WebKit/WebProcess/WebPage/WebFrame.cpp: (WebKit::WebFrame::removeFromTree): * Source/WebKit/WebProcess/WebPage/WebFrame.h: * Source/WebKit/WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::frameWasRemovedInAnotherProcess): * Source/WebKit/WebProcess/WebPage/WebPage.h: * Source/WebKit/WebProcess/WebPage/WebPage.messages.in: * Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h: * Tools/TestWebKitAPI/Tests/WebKitCocoa/SiteIsolation.mm: (TestWebKitAPI::TEST): Canonical link: https://commits.webkit.org/266301@main
WebKit · Jul 25, 2023 · 264836a · 264836a
1 parent f08fe22
commit 264836a
Show file tree

Hide file tree

Showing 26 changed files with 169 additions and 15 deletions.
diff --git a/Source/WebCore/html/HTMLFrameOwnerElement.cpp b/Source/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -80,6 +80,7 @@ void HTMLFrameOwnerElement::clearContentFrame()
 void HTMLFrameOwnerElement::disconnectContentFrame()
 {
     if (RefPtr frame = m_contentFrame.get()) {
+        frame->broadcastFrameRemovalToOtherProcesses();
         frame->frameDetached();
         frame->disconnectOwnerElement();
     }

diff --git a/Source/WebCore/loader/EmptyClients.cpp b/Source/WebCore/loader/EmptyClients.cpp
@@ -605,6 +605,10 @@ void EmptyFrameLoaderClient::dispatchDecidePolicyForNavigationAction(const Navig
 {
 }
 
+void EmptyFrameLoaderClient::broadcastFrameRemovalToOtherProcesses()
+{
+}
+
 void EmptyFrameLoaderClient::dispatchWillSendSubmitEvent(Ref<FormState>&&)
 {
 }

diff --git a/Source/WebCore/loader/EmptyFrameLoaderClient.h b/Source/WebCore/loader/EmptyFrameLoaderClient.h
@@ -96,6 +96,7 @@ class WEBCORE_EXPORT EmptyFrameLoaderClient : public LocalFrameLoaderClient {
     void dispatchDecidePolicyForResponse(const ResourceResponse&, const ResourceRequest&, PolicyCheckIdentifier, const String&, FramePolicyFunction&&) final;
     void dispatchDecidePolicyForNewWindowAction(const NavigationAction&, const ResourceRequest&, FormState*, const String&, PolicyCheckIdentifier, FramePolicyFunction&&) final;
     void dispatchDecidePolicyForNavigationAction(const NavigationAction&, const ResourceRequest&, const ResourceResponse& redirectResponse, FormState*, PolicyDecisionMode, PolicyCheckIdentifier, FramePolicyFunction&&) final;
+    void broadcastFrameRemovalToOtherProcesses() final;
     void cancelPolicyCheck() final;
 
     void dispatchUnableToImplementPolicy(const ResourceError&) final;

diff --git a/Source/WebCore/loader/LocalFrameLoaderClient.h b/Source/WebCore/loader/LocalFrameLoaderClient.h
@@ -368,6 +368,8 @@ class WEBCORE_EXPORT LocalFrameLoaderClient : public FrameLoaderClient {
 #if ENABLE(ARKIT_INLINE_PREVIEW_MAC)
     virtual void modelInlinePreviewUUIDs(CompletionHandler<void(Vector<String>)>&&) const { }
 #endif
+
+    virtual void broadcastFrameRemovalToOtherProcesses() = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
@@ -73,6 +73,7 @@ class Frame : public ThreadSafeRefCounted<Frame, WTF::DestructionThread::Main>,
     virtual void frameDetached() = 0;
     virtual bool preventsParentFromBeingComplete() const = 0;
     virtual void changeLocation(FrameLoadRequest&&) = 0;
+    virtual void broadcastFrameRemovalToOtherProcesses() = 0;
 
 protected:
     Frame(Page&, FrameIdentifier, FrameType, HTMLFrameOwnerElement*, Frame* parent);

diff --git a/Source/WebCore/page/LocalFrame.cpp b/Source/WebCore/page/LocalFrame.cpp
@@ -328,6 +328,11 @@ void LocalFrame::changeLocation(FrameLoadRequest&& request)
     loader().changeLocation(WTFMove(request));
 }
 
+void LocalFrame::broadcastFrameRemovalToOtherProcesses()
+{
+    loader().client().broadcastFrameRemovalToOtherProcesses();
+}
+
 void LocalFrame::invalidateContentEventRegionsIfNeeded(InvalidateContentEventRegionsReason reason)
 {
     if (!page() || !m_doc || !m_doc->renderView())

diff --git a/Source/WebCore/page/LocalFrame.h b/Source/WebCore/page/LocalFrame.h
@@ -295,6 +295,7 @@ class LocalFrame final : public Frame {
     void frameDetached() final;
     bool preventsParentFromBeingComplete() const final;
     void changeLocation(FrameLoadRequest&&) final;
+    void broadcastFrameRemovalToOtherProcesses() final;
 
     FrameView* virtualView() const final;
     DOMWindow* virtualWindow() const final;

diff --git a/Source/WebCore/page/RemoteFrame.cpp b/Source/WebCore/page/RemoteFrame.cpp
@@ -89,6 +89,11 @@ void RemoteFrame::changeLocation(FrameLoadRequest&& request)
     m_client->changeLocation(WTFMove(request));
 }
 
+void RemoteFrame::broadcastFrameRemovalToOtherProcesses()
+{
+    m_client->broadcastFrameRemovalToOtherProcesses();
+}
+
 FrameView* RemoteFrame::virtualView() const
 {
     return m_view.get();

diff --git a/Source/WebCore/page/RemoteFrame.h b/Source/WebCore/page/RemoteFrame.h
@@ -70,6 +70,7 @@ class RemoteFrame final : public Frame {
     void frameDetached() final;
     bool preventsParentFromBeingComplete() const final;
     void changeLocation(FrameLoadRequest&&) final;
+    void broadcastFrameRemovalToOtherProcesses() final;
 
     FrameView* virtualView() const final;
     DOMWindow* virtualWindow() const final;

diff --git a/Source/WebCore/page/RemoteFrameClient.h b/Source/WebCore/page/RemoteFrameClient.h
@@ -45,6 +45,7 @@ class RemoteFrameClient {
     virtual void postMessageToRemote(FrameIdentifier, std::optional<SecurityOriginData>, const MessageWithMessagePorts&) = 0;
     virtual void changeLocation(FrameLoadRequest&&) = 0;
     virtual String renderTreeAsText(size_t baseIndent, OptionSet<RenderAsTextFlag>) = 0;
+    virtual void broadcastFrameRemovalToOtherProcesses() = 0;
     virtual ~RemoteFrameClient() { }
 };
 

diff --git a/Source/WebKit/UIProcess/WebPageProxy.cpp b/Source/WebKit/UIProcess/WebPageProxy.cpp
@@ -5831,6 +5831,19 @@ void WebPageProxy::didFinishDocumentLoadForFrame(FrameIdentifier frameID, uint64
     }
 }
 
+void WebPageProxy::forEachWebContentProcess(Function<void(WebProcessProxy&)>&& function)
+{
+    for (auto& pair : internals().domainToRemotePageProxyMap) {
+        auto& remotePageProxy = pair.value;
+        if (!remotePageProxy) {
+            ASSERT_NOT_REACHED();
+            continue;
+        }
+        function(remotePageProxy->process());
+    }
+    function(process());
+}
+
 void WebPageProxy::createRemoteSubframesInOtherProcesses(WebFrameProxy& newFrame)
 {
     if (!m_preferences->siteIsolationEnabled())
@@ -5842,22 +5855,20 @@ void WebPageProxy::createRemoteSubframesInOtherProcesses(WebFrameProxy& newFrame
         return;
     }
 
-    auto& mainFrameProcess = process();
-    auto& newFrameProcess = newFrame.process();
-    auto& internals = this->internals();
+    forEachWebContentProcess([&](auto& webProcess) {
+        if (webProcess.processID() == newFrame.process().processID())
+            return;
+        webProcess.send(Messages::WebPage::CreateRemoteSubframe(parent->frameID(), newFrame.frameID()), webPageID());
+    });
+}
 
-    for (auto& pair : internals.domainToRemotePageProxyMap) {
-        auto& remotePageProxy = pair.value;
-        if (!remotePageProxy) {
-            ASSERT_NOT_REACHED();
-            continue;
-        }
-        if (&remotePageProxy->process() == &newFrameProcess)
-            continue;
-        remotePageProxy->send(Messages::WebPage::CreateRemoteSubframe(parent->frameID(), newFrame.frameID()));
-    }
-    if (&newFrameProcess != &mainFrameProcess)
-        send(Messages::WebPage::CreateRemoteSubframe(parent->frameID(), newFrame.frameID()));
+void WebPageProxy::broadcastFrameRemovalToOtherProcesses(WebCore::ProcessIdentifier processID, WebCore::FrameIdentifier frameID)
+{
+    forEachWebContentProcess([&](auto& webProcess) {
+        if (webProcess.coreProcessIdentifier() == processID)
+            return;
+        webProcess.send(Messages::WebPage::FrameWasRemovedInAnotherProcess(frameID), webPageID());
+    });
 }
 
 void WebPageProxy::didFinishLoadForFrame(FrameIdentifier frameID, FrameInfoData&& frameInfo, ResourceRequest&& request, uint64_t navigationID, const UserData& userData)

diff --git a/Source/WebKit/UIProcess/WebPageProxy.h b/Source/WebKit/UIProcess/WebPageProxy.h
@@ -28,6 +28,7 @@
 #include "APIObject.h"
 #include "MessageReceiver.h"
 #include "MessageSender.h"
+#include <WebCore/ProcessIdentifier.h>
 #include <WebCore/SleepDisablerIdentifier.h>
 #include <wtf/CheckedRef.h>
 #include <wtf/ProcessID.h>
@@ -2173,6 +2174,7 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
     HashMap<WebCore::RegistrableDomain, WeakPtr<RemotePageProxy>> takeRemotePageMap();
 
     void createRemoteSubframesInOtherProcesses(WebFrameProxy&);
+    void broadcastFrameRemovalToOtherProcesses(WebCore::ProcessIdentifier, WebCore::FrameIdentifier);
 
     void addOpenedPage(WebPageProxy&);
     bool hasOpenedPage() const;
@@ -2279,6 +2281,8 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
     void notifyProcessPoolToPrewarm();
     bool shouldUseBackForwardCache() const;
 
+    void forEachWebContentProcess(Function<void(WebProcessProxy&)>&&);
+
     bool shouldForceForegroundPriorityForClientNavigation() const;
 
     using WebFrameProxyMap = HashMap<WebCore::FrameIdentifier, Ref<WebFrameProxy>>;

diff --git a/Source/WebKit/UIProcess/WebPageProxy.messages.in b/Source/WebKit/UIProcess/WebPageProxy.messages.in
@@ -632,4 +632,5 @@ messages -> WebPageProxy {
     RequestCookieConsent() -> (enum:uint8_t WebCore::CookieConsentDecisionResult result)
 
     DidApplyLinkDecorationFiltering(URL originalURL, URL adjustedURL)
+    BroadcastFrameRemovalToOtherProcesses(WebCore::ProcessIdentifier processID, WebCore::FrameIdentifier frameID)
 }
diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -170,4 +170,14 @@ void WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(const Navigat
     }
 }
 
+void WebFrameLoaderClient::broadcastFrameRemovalToOtherProcesses()
+{
+    auto* webPage = m_frame->page();
+    if (!webPage) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    webPage->send(Messages::WebPageProxy::BroadcastFrameRemovalToOtherProcesses(Process::identifier(), m_frame->frameID()));
+}
+
 }
diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
@@ -38,6 +38,7 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
     WebFrameLoaderClient(Ref<WebFrame>&&);
 
     void dispatchDecidePolicyForNavigationAction(const WebCore::NavigationAction&, const WebCore::ResourceRequest&, const WebCore::ResourceResponse& redirectResponse, WebCore::FormState*, WebCore::PolicyDecisionMode, WebCore::PolicyCheckIdentifier, WebCore::FramePolicyFunction&&) override;
+    void broadcastFrameRemovalToOtherProcesses();
 
     Ref<WebFrame> m_frame;
 };

diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp b/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
@@ -1891,6 +1891,11 @@ void WebLocalFrameLoaderClient::getLoadDecisionForIcons(const Vector<std::pair<W
         webPage->send(Messages::WebPageProxy::GetLoadDecisionForIcon(icon.first, CallbackID::fromInteger(icon.second)));
 }
 
+void WebLocalFrameLoaderClient::broadcastFrameRemovalToOtherProcesses()
+{
+    WebFrameLoaderClient::broadcastFrameRemovalToOtherProcesses();
+}
+
 #if ENABLE(SERVICE_WORKER)
 void WebLocalFrameLoaderClient::didFinishServiceWorkerPageRegistration(bool success)
 {

diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.h b/Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.h
@@ -275,6 +275,8 @@ class WebLocalFrameLoaderClient final : public WebCore::LocalFrameLoaderClient,
 
     inline bool hasPlugInView() const;
 
+    void broadcastFrameRemovalToOtherProcesses() final;
+
     ScopeExit<Function<void()>> m_frameInvalidator;
 
 #if ENABLE(PDFKIT_PLUGIN)

diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp b/Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp
@@ -91,4 +91,9 @@ String WebRemoteFrameClient::renderTreeAsText(size_t baseIndent, OptionSet<WebCo
     return result;
 }
 
+void WebRemoteFrameClient::broadcastFrameRemovalToOtherProcesses()
+{
+    WebFrameLoaderClient::broadcastFrameRemovalToOtherProcesses();
+}
+
 }
diff --git a/Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.h b/Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.h
@@ -48,6 +48,7 @@ class WebRemoteFrameClient final : public WebCore::RemoteFrameClient, public Web
     void postMessageToRemote(WebCore::FrameIdentifier, std::optional<WebCore::SecurityOriginData>, const WebCore::MessageWithMessagePorts&) final;
     void changeLocation(WebCore::FrameLoadRequest&&) final;
     String renderTreeAsText(size_t baseIndent, OptionSet<WebCore::RenderAsTextFlag>) final;
+    void broadcastFrameRemovalToOtherProcesses() final;
 
     ScopeExit<Function<void()>> m_frameInvalidator;
 };

diff --git a/Source/WebKit/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit/WebProcess/WebPage/WebFrame.cpp
@@ -391,6 +391,32 @@ void WebFrame::didCommitLoadInAnotherProcess(std::optional<WebCore::LayerHosting
     }
 }
 
+void WebFrame::removeFromTree()
+{
+    RefPtr coreFrame = m_coreFrame.get();
+    if (!coreFrame) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    RefPtr webPage = m_page.get();
+    if (!webPage) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    auto* corePage = webPage->corePage();
+    if (!corePage) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    if (RefPtr localFrame = dynamicDowncast<LocalFrame>(*coreFrame); localFrame && localFrame->isRootFrame())
+        corePage->removeRootFrame(*localFrame);
+    if (RefPtr parent = coreFrame->tree().parent())
+        parent->tree().removeChild(*coreFrame);
+}
+
 void WebFrame::transitionToLocal(std::optional<WebCore::LayerHostingContextIdentifier> layerHostingContextIdentifier)
 {
     RefPtr remoteFrame = coreRemoteFrame();

diff --git a/Source/WebKit/WebProcess/WebPage/WebFrame.h b/Source/WebKit/WebProcess/WebPage/WebFrame.h
@@ -113,6 +113,7 @@ class WebFrame : public API::ObjectImpl<API::Object::Type::BundleFrame>, public
 
     void didCommitLoadInAnotherProcess(std::optional<WebCore::LayerHostingContextIdentifier>);
     void didFinishLoadInAnotherProcess();
+    void removeFromTree();
 
     void startDownload(const WebCore::ResourceRequest&, const String& suggestedName = { });
     void convertMainResourceLoadToDownload(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&);

diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.cpp b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
@@ -1102,6 +1102,16 @@ void WebPage::didFinishLoadInAnotherProcess(WebCore::FrameIdentifier frameID)
     frame->didFinishLoadInAnotherProcess();
 }
 
+void WebPage::frameWasRemovedInAnotherProcess(WebCore::FrameIdentifier frameID)
+{
+    auto* frame = WebProcess::singleton().webFrame(frameID);
+    if (!frame) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    frame->removeFromTree();
+}
+
 #if ENABLE(GPU_PROCESS)
 void WebPage::gpuProcessConnectionDidBecomeAvailable(GPUProcessConnection& gpuProcessConnection)
 {

diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.h b/Source/WebKit/WebProcess/WebPage/WebPage.h
@@ -605,6 +605,7 @@ class WebPage : public API::ObjectImpl<API::Object::Type::BundlePage>, public IP
     void continueWillSubmitForm(WebCore::FrameIdentifier, WebKit::FormSubmitListenerIdentifier);
     void didCommitLoadInAnotherProcess(WebCore::FrameIdentifier, std::optional<WebCore::LayerHostingContextIdentifier>);
     void didFinishLoadInAnotherProcess(WebCore::FrameIdentifier);
+    void frameWasRemovedInAnotherProcess(WebCore::FrameIdentifier);
 
     std::optional<WebCore::SimpleRange> currentSelectionAsRange();
 

diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit/WebProcess/WebPage/WebPage.messages.in
@@ -200,6 +200,7 @@ GenerateSyntheticEditingCommand(enum:uint8_t WebKit::SyntheticEditingCommandType
     ContinueWillSubmitForm(WebCore::FrameIdentifier frameID, WebKit::FormSubmitListenerIdentifier listenerID)
     DidCommitLoadInAnotherProcess(WebCore::FrameIdentifier frameID, std::optional<WebCore::LayerHostingContextIdentifier> layerHostingContextIdentifier)
     DidFinishLoadInAnotherProcess(WebCore::FrameIdentifier frameID)
+    FrameWasRemovedInAnotherProcess(WebCore::FrameIdentifier frameID)
 
     NavigateToPDFLinkWithSimulatedClick(String url, WebCore::IntPoint documentPoint, WebCore::IntPoint screenPoint)
     GetPDFFirstPageSize(WebCore::FrameIdentifier frameID) -> (WebCore::FloatSize size)

diff --git a/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -130,6 +130,7 @@ class WebFrameLoaderClient : public WebCore::LocalFrameLoaderClient, public CanM
     void dispatchDecidePolicyForResponse(const WebCore::ResourceResponse&, const WebCore::ResourceRequest&, WebCore::PolicyCheckIdentifier, const String&, WebCore::FramePolicyFunction&&) final;
     void dispatchDecidePolicyForNewWindowAction(const WebCore::NavigationAction&, const WebCore::ResourceRequest&, WebCore::FormState*, const WTF::String& frameName, WebCore::PolicyCheckIdentifier, WebCore::FramePolicyFunction&&) final;
     void dispatchDecidePolicyForNavigationAction(const WebCore::NavigationAction&, const WebCore::ResourceRequest&, const WebCore::ResourceResponse& redirectResponse, WebCore::FormState*, WebCore::PolicyDecisionMode, WebCore::PolicyCheckIdentifier, WebCore::FramePolicyFunction&&) final;
+    void broadcastFrameRemovalToOtherProcesses() final { }
     void cancelPolicyCheck() final;
 
     void dispatchUnableToImplementPolicy(const WebCore::ResourceError&) final;

diff --git a/Tools/TestWebKitAPI/Tests/WebKitCocoa/SiteIsolation.mm b/Tools/TestWebKitAPI/Tests/WebKitCocoa/SiteIsolation.mm
@@ -1139,4 +1139,56 @@ HTTPServer server({
     // FIXME: Implement CachedFrame for RemoteFrames and verify the page is resumed correctly.
 }
 
+TEST(SiteIsolation, RemoveFrames)
+{
+    HTTPServer server({
+        { "/webkit_main"_s, { "<iframe src='https://webkit.org/webkit_iframe' id='wk'></iframe><iframe src='https://example.com/example_iframe' id='ex'></iframe>"_s } },
+        { "/webkit_iframe"_s, { "hi!"_s } },
+        { "/example_iframe"_s, { "<iframe src='example_grandchild_frame'></iframe>"_s } },
+        { "/example_grandchild_frame"_s, { "hi!"_s } }
+    }, HTTPServer::Protocol::HttpsProxy);
+
+    auto navigationDelegate = adoptNS([TestNavigationDelegate new]);
+    [navigationDelegate allowAnyTLSCertificate];
+    auto configuration = server.httpsProxyConfiguration();
+    enableSiteIsolation(configuration);
+    auto webView = adoptNS([[WKWebView alloc] initWithFrame:CGRectZero configuration:configuration]);
+    webView.get().navigationDelegate = navigationDelegate.get();
+
+    [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"https://webkit.org/webkit_main"]]];
+    [navigationDelegate waitForDidFinishNavigation];
+
+    checkFrameTreesInProcesses(webView.get(), {
+        { "https://webkit.org"_s,
+            { { "https://webkit.org"_s }, { RemoteFrame, { { RemoteFrame } } } }
+        }, { RemoteFrame,
+            { { RemoteFrame }, { "https://example.com"_s, { { "https://example.com"_s } } } }
+        }
+    });
+
+    __block bool removedLocalFrame { false };
+    [webView evaluateJavaScript:@"var frame = document.getElementById('wk');frame.parentNode.removeChild(frame);" completionHandler:^(id, NSError *error) {
+        removedLocalFrame = true;
+    }];
+    Util::run(&removedLocalFrame);
+
+    checkFrameTreesInProcesses(webView.get(), {
+        { "https://webkit.org"_s,
+            { { RemoteFrame, { { RemoteFrame } } } }
+        }, { RemoteFrame,
+            { { "https://example.com"_s, { { "https://example.com"_s } } } }
+        }
+    });
+
+    __block bool removedRemoteFrame { false };
+    [webView evaluateJavaScript:@"var frame = document.getElementById('ex');frame.parentNode.removeChild(frame);" completionHandler:^(id, NSError *error) {
+        removedRemoteFrame = true;
+    }];
+    Util::run(&removedRemoteFrame);
+
+    checkFrameTreesInProcesses(webView.get(), {
+        { "https://webkit.org"_s }
+    });
+}
+
 }