Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ba42a3f3016687939dcd04e4de7c53d876eadab6
https://github.com/WebKit/WebKit/commit/ba42a3f3016687939dcd04e4de7c53d876eadab6
Author: Qianlang Chen <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target.html
A
LayoutTests/http/tests/site-isolation/inspector/dom/resources/splice-child-frame.html
M Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js
Log Message:
-----------
[Site Isolation] Web Inspector: Attaching a frame target loads unrequested
page DOM nodes
rdar://184285425
https://bugs.webkit.org/show_bug.cgi?id=321238
Reviewed by BJ Burg.
A frame with no owner element has nothing to splice into, and the main
frame never has one, so under Site Isolation at least one document
always stays pending. Once anything was pending, the frontend walked the
page body's children looking for an owner element, which delivers nodes
nothing asked for, along with whatever other agents attach to them.
That is observable: inspector/css/setLayoutContextTypeChangedMode.html
failed its first assertion under Site Isolation, because the walk
delivered the page's `display: grid` element and its layout flag before
the test queried the document. It now passes.
Nothing depends on the walk. It requested the body's children at the
default depth of one, so it could only ever reach an iframe that is a
direct child of `<body>`, and for that shape the retries on node arrival
splice the document as soon as anything expands the tree that far. The
one flow that might have relied on the walk running first, revealing a
node inside a cross-origin iframe, does not reach the tree at all:
DOMObserver drops `DOM.inspect` for frame targets before any node lookup
happens.
So drop the walk and let the retries on node arrival be the only
mechanism. They cannot help a document that has no owner element, nor
one whose owner element already carries a contentDocument from the page
target, but neither could the walk.
One retry was missing: children arriving for a frame target's own tree
did not trigger one, which left a nested cross-origin iframe's document
unspliced. Nothing changes with Site Isolation off, where no frame
targets are created and the pending list stays empty.
The new test covers both halves of the contract: attaching frame targets
loads no page nodes on its own, and a pending document is spliced once
its owner element arrives, including when that element belongs to
another frame target's tree.
Test:
http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target.html
*
LayoutTests/http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/dom/resources/splice-child-frame.html:
Added.
* Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js:
(WI.DOMManager):
(WI.DOMManager.prototype._spliceFrameDocumentIntoPageTree):
(WI.DOMManager.prototype._frameTargetSetChildNodes):
(WI.DOMManager.prototype._setDocument):
(WI.DOMManager.prototype._ensurePageBodyChildrenLoaded): Deleted.
Canonical link: https://commits.webkit.org/320273@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
