Skip to content

[Site Isolation] Don't seed new RemoteFrame with the dying LocalFrame's stale FrameTreeSyncData#65311

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
zakariaridouh:eng/Site-Isolation-Don-t-seed-new-RemoteFrame-with-the-dying-LocalFrame-s-stale-FrameTreeSyncData
May 21, 2026
Merged

[Site Isolation] Don't seed new RemoteFrame with the dying LocalFrame's stale FrameTreeSyncData#65311
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
zakariaridouh:eng/Site-Isolation-Don-t-seed-new-RemoteFrame-with-the-dying-LocalFrame-s-stale-FrameTreeSyncData

Conversation

@zakariaridouh
Copy link
Copy Markdown
Contributor

@zakariaridouh zakariaridouh commented May 20, 2026

e5c4d1b

[Site Isolation] Don't seed new RemoteFrame with the dying LocalFrame's stale FrameTreeSyncData
https://bugs.webkit.org/show_bug.cgi?id=315216
rdar://177546607

Reviewed by Sihui Liu.

In WebFrame::loadDidCommitInAnotherProcess, the new RemoteFrame was
seeded with the dying LocalFrame's FrameTreeSyncData, whose
frameDocumentSecurityOrigin reflects the pre-swap document,  not
the cross-origin document the frame is navigating to. The
post-commit FrameTreeSyncDataChangedInAnotherProcess IPC arrives
shortly to refresh this, but any task that queries the remote
window in the meantime (e.g. a BroadcastChannel dispatch fired from
pagehide) can observe a cached origin that spuriously matches the
active document. BindingSecurity correctly denies the access (the
target is remote), but DOMWindow::crossDomainAccessErrorMessage
then asserts that active and target origins are not
same-origin-domain, which flakily crashes the
http/tests/site-isolation/page-lifecycle/{pagehide,pageswap,unload}.html
tests.

Seed the new RemoteFrame with an empty FrameTreeSyncData (opaque
origin) instead, matching the pattern already used by
WebFrame::createSubframe and WebFrameProxy::remoteProcessDidTerminate.
The post-commit broadcast still arrives via the same IPC connection
and supplies the real new values; until then, opaque is an honest
"unknown" placeholder that never compares same-origin.

Remove the tests from the flakey expectations.

* LayoutTests/platform/mac-wk2/TestExpectations:
* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::loadDidCommitInAnotherProcess):

Canonical link: https://commits.webkit.org/313620@main

40f024f

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe 🛠 win ⏳ 🛠 ios-apple
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug 🧪 wpe-wk2 🧪 win-tests ⏳ 🛠 mac-apple
✅ 🧪 webkitperl 🧪 ios-wk2 🧪 api-mac ✅ 🧪 api-wpe ⏳ 🛠 vision-apple
🧪 ios-wk2-wpt 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
🛠 ios-safer-cpp ✅ 🧪 mac-wk2 🧪 gtk-wk2
✅ 🛠 vision 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ✅ 🛠 playstation
✅ 🧪 vision-wk2 🧪 mac-intel-wk2
✅ 🛠 tv 🛠 mac-safer-cpp
✅ 🛠 tv-sim ✅ 🧪 mac-site-isolation
✅ 🛠 watch
✅ 🛠 watch-sim

@zakariaridouh zakariaridouh requested a review from cdumez as a code owner May 20, 2026 18:47
@zakariaridouh zakariaridouh self-assigned this May 20, 2026
@zakariaridouh zakariaridouh added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label May 20, 2026
@zakariaridouh zakariaridouh requested a review from atar13 May 20, 2026 18:51
@zakariaridouh zakariaridouh force-pushed the eng/Site-Isolation-Don-t-seed-new-RemoteFrame-with-the-dying-LocalFrame-s-stale-FrameTreeSyncData branch from 5143d10 to 1d5d600 Compare May 20, 2026 20:48
@zakariaridouh zakariaridouh requested a review from szewai May 20, 2026 21:08
Comment thread Source/WebKit/WebProcess/WebPage/WebFrame.cpp
@zakariaridouh zakariaridouh force-pushed the eng/Site-Isolation-Don-t-seed-new-RemoteFrame-with-the-dying-LocalFrame-s-stale-FrameTreeSyncData branch from 1d5d600 to ca13404 Compare May 20, 2026 23:04
@zakariaridouh zakariaridouh force-pushed the eng/Site-Isolation-Don-t-seed-new-RemoteFrame-with-the-dying-LocalFrame-s-stale-FrameTreeSyncData branch from ca13404 to 40f024f Compare May 21, 2026 00:37
@zakariaridouh zakariaridouh added the merge-queue Applied to send a pull request to merge-queue label May 21, 2026
…'s stale FrameTreeSyncData

https://bugs.webkit.org/show_bug.cgi?id=315216
rdar://177546607

Reviewed by Sihui Liu.

In WebFrame::loadDidCommitInAnotherProcess, the new RemoteFrame was
seeded with the dying LocalFrame's FrameTreeSyncData, whose
frameDocumentSecurityOrigin reflects the pre-swap document,  not
the cross-origin document the frame is navigating to. The
post-commit FrameTreeSyncDataChangedInAnotherProcess IPC arrives
shortly to refresh this, but any task that queries the remote
window in the meantime (e.g. a BroadcastChannel dispatch fired from
pagehide) can observe a cached origin that spuriously matches the
active document. BindingSecurity correctly denies the access (the
target is remote), but DOMWindow::crossDomainAccessErrorMessage
then asserts that active and target origins are not
same-origin-domain, which flakily crashes the
http/tests/site-isolation/page-lifecycle/{pagehide,pageswap,unload}.html
tests.

Seed the new RemoteFrame with an empty FrameTreeSyncData (opaque
origin) instead, matching the pattern already used by
WebFrame::createSubframe and WebFrameProxy::remoteProcessDidTerminate.
The post-commit broadcast still arrives via the same IPC connection
and supplies the real new values; until then, opaque is an honest
"unknown" placeholder that never compares same-origin.

Remove the tests from the flakey expectations.

* LayoutTests/platform/mac-wk2/TestExpectations:
* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::loadDidCommitInAnotherProcess):

Canonical link: https://commits.webkit.org/313620@main
@webkit-commit-queue webkit-commit-queue force-pushed the eng/Site-Isolation-Don-t-seed-new-RemoteFrame-with-the-dying-LocalFrame-s-stale-FrameTreeSyncData branch from 40f024f to e5c4d1b Compare May 21, 2026 01:13
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

Committed 313620@main (e5c4d1b): https://commits.webkit.org/313620@main

Reviewed commits have been landed. Closing PR #65311 and removing active labels.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

New Bugs Unclassified bugs are placed in this component until the correct component can be determined.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants