[Site Isolation] Don't seed new RemoteFrame with the dying LocalFrame's stale FrameTreeSyncData#65311
Merged
Conversation
Collaborator
|
EWS run on previous version of this PR (hash 5143d10) Details |
5143d10 to
1d5d600
Compare
Collaborator
|
EWS run on previous version of this PR (hash 1d5d600) Details
|
szewai
approved these changes
May 20, 2026
1d5d600 to
ca13404
Compare
Collaborator
|
EWS run on previous version of this PR (hash ca13404) Details
|
ca13404 to
40f024f
Compare
Collaborator
|
EWS run on current version of this PR (hash 40f024f) Details
|
…'s stale FrameTreeSyncData https://bugs.webkit.org/show_bug.cgi?id=315216 rdar://177546607 Reviewed by Sihui Liu. In WebFrame::loadDidCommitInAnotherProcess, the new RemoteFrame was seeded with the dying LocalFrame's FrameTreeSyncData, whose frameDocumentSecurityOrigin reflects the pre-swap document, not the cross-origin document the frame is navigating to. The post-commit FrameTreeSyncDataChangedInAnotherProcess IPC arrives shortly to refresh this, but any task that queries the remote window in the meantime (e.g. a BroadcastChannel dispatch fired from pagehide) can observe a cached origin that spuriously matches the active document. BindingSecurity correctly denies the access (the target is remote), but DOMWindow::crossDomainAccessErrorMessage then asserts that active and target origins are not same-origin-domain, which flakily crashes the http/tests/site-isolation/page-lifecycle/{pagehide,pageswap,unload}.html tests. Seed the new RemoteFrame with an empty FrameTreeSyncData (opaque origin) instead, matching the pattern already used by WebFrame::createSubframe and WebFrameProxy::remoteProcessDidTerminate. The post-commit broadcast still arrives via the same IPC connection and supplies the real new values; until then, opaque is an honest "unknown" placeholder that never compares same-origin. Remove the tests from the flakey expectations. * LayoutTests/platform/mac-wk2/TestExpectations: * Source/WebKit/WebProcess/WebPage/WebFrame.cpp: (WebKit::WebFrame::loadDidCommitInAnotherProcess): Canonical link: https://commits.webkit.org/313620@main
40f024f to
e5c4d1b
Compare
Collaborator
|
Committed 313620@main (e5c4d1b): https://commits.webkit.org/313620@main Reviewed commits have been landed. Closing PR #65311 and removing active labels. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
e5c4d1b
40f024f
🛠 win🧪 wpe-wk2🧪 win-tests🧪 ios-wk2🧪 api-mac🧪 ios-wk2-wpt🧪 api-mac-debug🧪 api-ios🛠 ios-safer-cpp🧪 gtk-wk2🧪 mac-AS-debug-wk2🧪 mac-intel-wk2🛠 mac-safer-cpp