Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 177f74567f875555ca57a01715af2ae322e2ffad
https://github.com/WebKit/WebKit/commit/177f74567f875555ca57a01715af2ae322e2ffad
Author: Anthony Tarbinian <[email protected]>
Date: 2026-07-21 (Tue, 21 Jul 2026)
Changed paths:
A
LayoutTests/fast/events/site-isolation/window-open-and-navigate-preserves-opener-expected.txt
A
LayoutTests/fast/events/site-isolation/window-open-and-navigate-preserves-opener.html
M Source/WebCore/page/DOMWindow.cpp
M Source/WebCore/page/Page.cpp
M Source/WebCore/page/Page.h
M Source/WebKit/UIProcess/BrowsingContextGroup.cpp
Log Message:
-----------
[Site Isolation] window.opener is null after a window.open() popup
process-swaps to an empty site
https://bugs.webkit.org/show_bug.cgi?id=318903
rdar://181740350
Reviewed by Alex Christensen.
When site isolation is enabled, a popup opened to about:blank by window.open()
will
share its opener's process.
Then, the popup navigates to another empty site which causes a process swap.
The bug is that after that swap, window.opener is null.
The test fast/events/before-unload-navigate-different-window.html revealed
this bug and is failing with site isolation enabled.
The test does the following:
1. window.open('about:blank'). The popup stays in the opener's process.
2. The test navigates the popup to resources/message-opener.html. This
is treated as a file:// URL which triggers a process swap for the popup.
A process swap happens because the opener's process committed a
meaningful load by loading the main test page (see
WebProcessPool::processForNavigationInternal + the
hasCommittedAnyMeaningfulProvisionalLoads check)
3. Now, we have the opener (which is a file:// empty site) and the popup
(which is also a file:// empty site). However, the opener and popup
are in different processes.
4. WebKit sees that the two pages are same site and doesn't set up a
RemotePageProxy for the opener in the popup's new process. This bug
is in BrowsingContextGroup::addFrameProcessAndInjectPageContextIf.
5. With no RemotePageProxy for the opener, the popup has no way of
accessing the opener in a different process. So, window.opener is
null in the test and the test can't postMessage to the opener.
BrowsingContextGroup::addFrameProcessAndInjectPageContextIf decides which
existing pages need a RemotePageProxy created in a new process. It skipped
creating one for any existing page whose site matched the new process's site.
In this test case, the logic saw that the new process (popup file:// empty site)
and the existing page (opener main test page file:// empty site) were
same site. As such, it assumed these two pages were in the same process
(which is not true since the popup process-swapped). Therefore, it skipped
adding the opener's RemotePageProxy in the popup's new process.
This patch additionally checks process identity in the case where both
the new process's site and the existing page's site are empty. When the
existing empty-site page is actually in a different process, we now
create the RemotePageProxy it needs. Behavior for non-empty sites is
unchanged (the process-identity check is only consulted for empty sites).
Added a regression test that opens an about:blank popup, navigates it
cross-process under site isolation, and verifies the popup can still
postMessage back via window.opener. This regression test exposed a
GTK/WPE only assertion so I added a site isolation specific relaxation
which allows a page to not have a local root frame.
Test:
fast/events/window-open-and-navigate-preserves-opener-under-site-isolation.html
*
LayoutTests/fast/events/site-isolation/window-open-and-navigate-preserves-opener-expected.txt:
Added.
*
LayoutTests/fast/events/site-isolation/window-open-and-navigate-preserves-opener.html:
Added.
* Source/WebCore/page/DOMWindow.cpp:
(WebCore::DOMWindow::crossDomainAccessErrorMessage):
* Source/WebCore/page/Page.cpp:
(WebCore::Page::finalizeRenderingUpdate):
* Source/WebCore/page/Page.h:
* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:
(WebKit::BrowsingContextGroup::addFrameProcessAndInjectPageContextIf):
Canonical link: https://commits.webkit.org/317670@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
