Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 39cd4a1169b994e8c7af20c4cad24f1e0c17ec63
https://github.com/WebKit/WebKit/commit/39cd4a1169b994e8c7af20c4cad24f1e0c17ec63
Author: Zak Ridouh <[email protected]>
Date: 2026-10-14 (Wed, 14 Oct 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-cross-site-navigation-splice-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-cross-site-navigation-splice.html
A
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-new-frame-target-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-new-frame-target.html
M Source/WebCore/inspector/agents/frame/FrameCSSAgent.cpp
M Source/WebCore/inspector/agents/frame/FrameCSSAgent.h
M Source/WebCore/inspector/agents/frame/FrameDOMAgent.cpp
M Source/WebInspectorUI/UserInterface/Controllers/CSSManager.js
Log Message:
-----------
[Site Isolation] Web Inspector: Cross-origin iframes added while the Layout
panel is open don't list their grids and flex containers
https://bugs.webkit.org/show_bug.cgi?id=327031
rdar://189647875
Reviewed by Qianlang Chen.
CSSManager applied `layoutContextTypeChangedMode` only to the targets that
existed when the mode was set.
Under Site Isolation, frame targets come and go with iframe navigations, so a
frame target created while the
Layout panel was open stayed in `Observed` mode. Its grids and flex containers
were not reported until the
panel was hidden and shown again.
Applying the mode to the new target is not enough. Each committed load resets
FrameDOMAgent's bindings, so
FrameCSSAgent cannot push a grid that is laid out before the frontend requests
the new document, and it never
retries. A new frame target hits this reliably: its first document is the
initial empty one, and the frontend
asks for the loaded one only after the provisional target commits.
CSSManager now remembers the mode and applies it to each new frame target in
`initializeTarget`, after `CSS.enable`.
Page targets are left alone: they request their document later, and
InspectorCSSAgent does not push nodes once it arrives.
It sends nothing for the default `Observed` mode, so targets that exist at
startup get no extra command.
In `All` mode, FrameDOMAgent::getDocument now has FrameCSSAgent push every
layout context node again, once the
reply has been sent.
The main frame's FrameTarget now also gets `All`. Its DOM tree is never spliced
into the page tree, and FrameCSSAgent
pushing grid paths into it binds the main document's `<iframe>` elements there.
A cross-origin iframe's document could
then splice into that hidden `<iframe>` instead of the one in the page tree.
FrameCSSAgent now skips the push when
the page's CSS agent reports the document, which
`documentIsReportedByPageCSSAgent` already tells it.
The test covers a new iframe and a reload in the same frame target. It keeps a
node list the way
LayoutDetailsSidebarPanel keeps its node sets, rebuilds that list as the frame
document is spliced, before the
grids arrive, and checks that the grids still reach it. They do through
`LayoutFlagsChanged`, which each new
WI.DOMNode sends, so DOMManager needs no change. The reload case holds the
frontend's request for the new
document until the frame has loaded, so the grids are always laid out first.
A second test navigates the main frame cross-site and checks that the iframe's
document ends up in the page tree.
Tests:
http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-cross-site-navigation-splice.html
http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-new-frame-target.html
*
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-cross-site-navigation-splice-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-cross-site-navigation-splice.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-new-frame-target-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-new-frame-target.html:
Added.
* Source/WebCore/inspector/agents/frame/FrameCSSAgent.cpp:
(WebCore::FrameCSSAgent::setLayoutContextTypeChangedMode):
(WebCore::FrameCSSAgent::pushLayoutContextNodesToFrontend): Extracted from
`setLayoutContextTypeChangedMode`. Skips a
document that the page's CSS agent reports.
(WebCore::FrameCSSAgent::didBindDocument): Defers the push to the dispatch
timer, because the frontend drops
nodes that arrive before the `DOM.getDocument` reply.
(WebCore::FrameCSSAgent::nodesWithPendingLayoutFlagsChangeDispatchTimerFired):
Likewise for a node whose flags changed.
(WebCore::FrameCSSAgent::reset):
* Source/WebCore/inspector/agents/frame/FrameCSSAgent.h:
* Source/WebCore/inspector/agents/frame/FrameDOMAgent.cpp:
(WebCore::FrameDOMAgent::getDocument):
* Source/WebInspectorUI/UserInterface/Controllers/CSSManager.js:
(WI.CSSManager): Stores the current mode.
(WI.CSSManager.prototype.initializeTarget):
(WI.CSSManager.prototype.set layoutContextTypeChangedMode):
(WI.CSSManager.prototype._setLayoutContextTypeChangedModeForTarget): Shared by
the setter and `initializeTarget`.
Canonical link: https://commits.webkit.org/323791@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
