Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ec3d95f1d71b2324fbe87bb0cbcdd2372efb8031
https://github.com/WebKit/WebKit/commit/ec3d95f1d71b2324fbe87bb0cbcdd2372efb8031
Author: Basuke Suzuki <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/inspector/page/resources/bootstrap-frame-with-child.html
A
LayoutTests/http/tests/site-isolation/inspector/page/resources/bootstrap-frame.html
A
LayoutTests/http/tests/site-isolation/inspector/page/resources/bootstrap-scriptless-frame.html
A
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-after-disable-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-after-disable-cross-origin-iframe.html
A
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-cross-origin-iframe.html
A
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-removes-own-frame-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-removes-own-frame-cross-origin-iframe.html
M Source/JavaScriptCore/inspector/protocol/Page.json
M Source/WebCore/inspector/InspectorInstrumentation.cpp
M Source/WebCore/inspector/InspectorResourceUtilities.cpp
M Source/WebCore/inspector/agents/InspectorPageAgent.cpp
M Source/WebCore/inspector/agents/InspectorPageAgent.h
M Source/WebCore/inspector/hooks/PageAgentInstrumentation.h
M Source/WebInspectorUI/UserInterface/Controllers/NetworkManager.js
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h
M Source/WebKit/WebProcess/Inspector/PageAgentProxy.cpp
M Source/WebKit/WebProcess/Inspector/PageAgentProxy.h
M Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp
M Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h
M Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in
Log Message:
-----------
[Site Isolation] Web Inspector: Inspector Bootstrap Script does not run in
cross-origin iframes
https://bugs.webkit.org/show_bug.cgi?id=308897
rdar://171780781
Reviewed by Qianlang Chen.
Page.setBootstrapScript was declared for the page target only, so the script
reached only the
main-frame process. Its InspectorPageAgent evaluated it there, including in
same-process
subframes. A cross-origin iframe's process has no page target, so its frames
never ran the
script. ProxyingPageAgent::setBootstrapScript was a stub.
Show Paint Rects solved the same reach problem by relaying its toggle from the
main-frame
process to the UIProcess, which fans it out. That relay is not safe for a
script: a compromised
WebContent process could then make the UIProcess inject script into another
site's process.
Instead, the frontend now also sends the script to the WebPage target, so the
UIProcess gets it
only from the frontend:
- Page.json declares setBootstrapScript for "web-page" too. NetworkManager
sends it to
WI.backendTarget, which WI.targets excludes, once the first Frame target shows
that
ProxyingPageAgent exists. Without Site Isolation that agent is never created,
even though
hasCommand() is true from the static protocol.
- ProxyingPageAgent stores the script, sends SetBootstrapScript to every
process registered for
page instrumentation, replays it from enableInstrumentationForProcess(), and
drops it on
disable(). For a provisional frame in a new process, that replay goes out before
WebFrameProxy::prepareForProvisionalLoadInProcess() lets the load proceed, so
the script is in
place before the frame's first document commits.
- WebInspectorBackend keeps the script per page and seeds every per-frame
PageAgentProxy with it.
InspectorInstrumentation gets the script from the enabled page proxy through
the new
PageAgentInstrumentation::bootstrapScriptToEvaluate() and evaluates it in the
main world. The
proxy returns nothing for frames whose InstrumentingAgents have an enabled
InspectorPageAgent,
because that agent already evaluates its own copy in the main-frame process.
InspectorInstrumentation evaluates the script itself, and only after releasing
its CheckedPtr to
the proxy. The script can detach its own frame, e.g. with frameElement.remove()
in a same-site
nested frame of a cross-origin process, and the detach destroys that frame's
PageAgentProxy. A
CheckedPtr still pointing at it crashes when it goes out of scope.
The fan-out walks ProxyingPageAgent's (process, page) registrations through the
new
forEachInstrumentedProcess(), not WebPageProxy::forEachWebContentProcess(). The
latter also lists
processes that hold only a remote page for the inspected page, e.g. one created
for a cross-site
iframe in a popup. Their creation parameters turn page instrumentation on, but
they are never
registered, so disable() never reached them: the script stayed there and ran in
frames the page
added after the inspector closed. setShowPaintRects() had the same problem, and
it and disable()
now share the walk.
The self-removing frame test also hit a pre-existing null dereference. Under
Site Isolation, a
document-start user script is what first creates the cross-origin frame's
window proxy, so the
bootstrap script runs inside that creation, and once it detaches the frame the
user script is
still parsed there. FrameDebuggerAgent::sourceMapURLForScript() then reaches
ResourceUtilities::cachedResource(), which dereferenced the detached frame's
null page. It now
returns null when the frame has no page.
The evaluation moves into InspectorPageAgent::evaluateBootstrapScript() so both
paths share it
and keep the web-inspector://bootstrap.js URL that the frontend uses to
recognize the script.
Tests:
http/tests/site-isolation/inspector/page/set-bootstrap-script-after-disable-cross-origin-iframe.html
http/tests/site-isolation/inspector/page/set-bootstrap-script-cross-origin-iframe.html
http/tests/site-isolation/inspector/page/set-bootstrap-script-removes-own-frame-cross-origin-iframe.html
*
LayoutTests/http/tests/site-isolation/inspector/page/resources/bootstrap-frame-with-child.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/resources/bootstrap-frame.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/resources/bootstrap-scriptless-frame.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-after-disable-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-after-disable-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-removes-own-frame-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/set-bootstrap-script-removes-own-frame-cross-origin-iframe.html:
Added.
* Source/JavaScriptCore/inspector/protocol/Page.json:
* Source/WebCore/inspector/InspectorInstrumentation.cpp:
(WebCore::evaluatePageProxyBootstrapScript):
(WebCore::InspectorInstrumentation::didClearWindowObjectInWorldImpl):
* Source/WebCore/inspector/InspectorResourceUtilities.cpp:
(Inspector::ResourceUtilities::cachedResource):
* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
(WebCore::InspectorPageAgent::evaluateBootstrapScript):
* Source/WebCore/inspector/agents/InspectorPageAgent.h:
* Source/WebCore/inspector/hooks/PageAgentInstrumentation.h:
* Source/WebInspectorUI/UserInterface/Controllers/NetworkManager.js:
(WI.NetworkManager.prototype.initializeTarget):
(WI.NetworkManager.prototype.set bootstrapScriptEnabled):
(WI.NetworkManager.prototype.destroyBootstrapScript):
(WI.NetworkManager.prototype._handleBootstrapScriptContentDidChange):
(WI.NetworkManager.prototype._setBootstrapScriptSource):
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp:
(Inspector::ProxyingPageAgent::enableInstrumentationForProcess):
(Inspector::ProxyingPageAgent::forEachInstrumentedProcess):
(Inspector::ProxyingPageAgent::disable):
(Inspector::ProxyingPageAgent::setBootstrapScript):
(Inspector::ProxyingPageAgent::setShowPaintRects):
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h:
* Source/WebKit/WebProcess/Inspector/PageAgentProxy.cpp:
(WebKit::PageAgentProxy::bootstrapScriptToEvaluate):
(WebKit::PageAgentProxy::didClearWindowObjectInWorld): Deleted.
* Source/WebKit/WebProcess/Inspector/PageAgentProxy.h:
(WebKit::PageAgentProxy::setBootstrapScript):
* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:
(WebKit::WebInspectorBackend::ensurePageInstrumentationForFrame):
(WebKit::WebInspectorBackend::disablePageInstrumentation):
(WebKit::WebInspectorBackend::setBootstrapScript):
* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h:
* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in:
Canonical link: https://commits.webkit.org/323585@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
