Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8d3c0a9c276d5a9d8f2942f435e88dda84a3f279
https://github.com/WebKit/WebKit/commit/8d3c0a9c276d5a9d8f2942f435e88dda84a3f279
Author: Ryosuke Niwa <[email protected]>
Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths:
M LayoutTests/platform/ios-site-isolation/TestExpectations
M Source/WebCore/page/DOMWindow.cpp
M Source/WebCore/page/RemoteDOMWindow.cpp
M Source/WebCore/page/RemoteDOMWindow.h
Log Message:
-----------
[Site Isolation] http/tests/dom/cross-origin-detached-window-properties.html
fails
https://bugs.webkit.org/show_bug.cgi?id=324712
Reviewed by Chris Dumez.
With site isolation a cross-origin iframe is a RemoteFrame, so its window is a
RemoteDOMWindow.
Removing the iframe runs RemoteFrame::frameDetached, which nulls out
RemoteDOMWindow's frame, and
that frame was the window's only source of target origin and sandbox state.
crossDomainAccessErrorMessage
then gave up and returned a null string, so every access threw the default
SecurityError text,
"The operation is insecure.", rather than naming the origin that was blocked.
Without site isolation the window is a LocalDOMWindow, which keeps its Document
after detachment, so
the message was still built there. Have RemoteDOMWindow snapshot the frame's
security origin and
sandbox-origin flag as the frame detaches, the way a detached LocalDOMWindow
keeps reporting the state
of the document it is still holding on to, and key
crossDomainAccessErrorMessage off the
RemoteDOMWindow rather than off its possibly-gone frame.
* LayoutTests/platform/ios-site-isolation/TestExpectations: Remove failing test
expectation.
* Source/WebCore/page/DOMWindow.cpp:
(WebCore::DOMWindow::crossDomainAccessErrorMessage): Ask the RemoteDOMWindow
for the target origin and
sandbox state, and drop the now-redundant remoteFrameSecurityOrigin local in
favor of targetOrigin.
* Source/WebCore/page/RemoteDOMWindow.cpp:
(WebCore::RemoteDOMWindow::frameDetached):
(WebCore::RemoteDOMWindow::frameDocumentSecurityOriginOrOpaque const):
(WebCore::RemoteDOMWindow::frameDocumentIsSandboxedOrigin const):
* Source/WebCore/page/RemoteDOMWindow.h:
Canonical link: https://commits.webkit.org/321604@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
