Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e50f2af9ac990ce02be12a4c8eaddc7f22938b8b
https://github.com/WebKit/WebKit/commit/e50f2af9ac990ce02be12a4c8eaddc7f22938b8b
Author: Qianlang Chen <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/inspector/dom/push-node-to-frontend-frame-target-id-space-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/dom/push-node-to-frontend-frame-target-id-space.html
M Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js
M Source/WebInspectorUI/UserInterface/Models/DOMNode.js
M Source/WebInspectorUI/UserInterface/Views/FormattedValue.js
Log Message:
-----------
[Site Isolation]: Web Inspector: console.log of any DOM element shows nothing
or an unrelated node (frame target node ids resolved against the page target)
https://bugs.webkit.org/show_bug.cgi?id=322796
rdar://184278903
Reviewed by BJ Burg.
Original patch by Alexey Proskuryakov <[email protected]>; reworked to
incorporate review feedback.
A DOM node id is only unique within the agent that issued it, so
WI.DOMManager._idToDOMNode keys frame-target nodes by their owning
target, as the frame-target event handlers already do.
pushNodeToFrontend did not: it returned the raw id from the frame
target's DOM.requestNode reply, and callers pass that to nodeForId, a
lookup by scoped key. That either found nothing or found an unrelated
page-target node with the same integer, which is no accident: the main
frame has a frame target of its own, so its DOM is bound in both id
spaces, each numbering from 1. Scope the id inside pushNodeToFrontend
rather than at its call sites, so a future caller cannot repeat this.
FormattedValue.createElementForNode now tests the resolved node rather
than the id. An id that does not resolve to a node is exactly the case
the fallback description text exists for, whereas testing only that the
id was non-zero let the code go on to build a tree outline around null,
which threw on treeOutline.children[0] and left the console entry blank.
As a drive-by, building the scoped key was open-coded in many places
in the file. Add DOMManager.keyForNodeId to make the code more
maintainable.
Test: inspector/dom/push-node-to-frontend-frame-target-id-space.html
* Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js:
(WI.DOMManager.prototype._initializeFrameTarget):
(WI.DOMManager.prototype.pushNodeToFrontend):
(WI.DOMManager.prototype._cleanupFrameTarget):
(WI.DOMManager.prototype.nodeForIdInFrameTarget):
(WI.DOMManager.prototype._frameTargetSetChildNodes):
(WI.DOMManager.prototype._frameTargetAttributeModified):
(WI.DOMManager.prototype._frameTargetAttributeRemoved):
(WI.DOMManager.prototype._loadFrameTargetNodeAttributes):
(WI.DOMManager.prototype._frameTargetCharacterDataModified):
(WI.DOMManager.prototype._frameTargetChildNodeCountUpdated):
(WI.DOMManager.prototype._frameTargetChildNodeInserted):
(WI.DOMManager.prototype._frameTargetChildNodeRemoved):
(WI.DOMManager.prototype._frameTargetShadowRootPushed):
(WI.DOMManager.prototype._frameTargetShadowRootPopped):
(WI.DOMManager.prototype._frameTargetWillDestroyDOMNode):
(WI.DOMManager.prototype._frameTargetCustomElementStateChanged):
(WI.DOMManager.prototype._frameTargetPseudoElementAdded):
(WI.DOMManager.prototype._frameTargetPseudoElementRemoved):
(WI.DOMManager.keyForNodeId):
* Source/WebInspectorUI/UserInterface/Views/FormattedValue.js:
(WI.FormattedValue.createElementForNode):
*
LayoutTests/http/tests/site-isolation/inspector/dom/push-node-to-frontend-frame-target-id-space-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/dom/push-node-to-frontend-frame-target-id-space.html:
Added.
* Source/WebInspectorUI/UserInterface/Models/DOMNode.js:
Canonical link: https://commits.webkit.org/320280@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
