Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 10740b3a1fa50537a0fbea349eb9130ac609d852
https://github.com/WebKit/WebKit/commit/10740b3a1fa50537a0fbea349eb9130ac609d852
Author: Zak Ridouh <[email protected]>
Date: 2026-10-03 (Sat, 03 Oct 2026)
Changed paths:
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/dom/Document.cpp
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
M Source/WebKit/NetworkProcess/NetworkResourceLoader.h
M Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp
M Source/WebKit/UIProcess/API/APIPageConfiguration.cpp
M Source/WebKit/UIProcess/API/APIPageConfiguration.h
M Source/WebKit/UIProcess/API/Cocoa/WKProcessPool.mm
M Source/WebKit/UIProcess/API/Cocoa/WKProcessPoolPrivate.h
M Source/WebKit/UIProcess/BrowsingContextGroup.cpp
M Source/WebKit/UIProcess/BrowsingContextGroup.h
M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebProcessPool.cpp
M Source/WebKit/UIProcess/WebProcessPool.h
M Tools/Scripts/webkitpy/api_tests/allowlist.txt
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Site Isolation] Cross-origin isolation should belong to the browsing context
group
https://bugs.webkit.org/show_bug.cgi?id=299201
rdar://116203642
Reviewed by Ryosuke Niwa.
A COOP: same-origin + COEP: require-corp page only got a
CrossOriginMode::Isolated process for its
main frame. Its cross-site subframes, the site isolation shared process, and
the process launched
after a crash were all Shared, so those frames had no SharedArrayBuffer. A
process's mode is fixed
at launch and applies to everything it hosts, so it must be known when the
process is picked.
Make the mode a property of the BrowsingContextGroup, as in the HTML spec, and
honor it everywhere
a process is picked for the group:
- WebProcessPool::processForSite() takes the mode. Cached, prewarmed and
suspended processes are
never isolated, so it always launches a new process for an isolated group.
- processForNavigationInternal() swaps when the source process's mode differs
from the group's, as
it does for Lockdown Mode. Back/forward navigations only reuse a process with
a matching mode.
- An isolated group does not use the shared process.
- Only an opener brings a page into an isolated group. A related web view no
longer joins one, and
a noopener popup no longer shares its opener's process across modes. A
noopener blob: URL popup
that does not get its opener's process now loads in its own, as it already
does with site
isolation.
Since the group now grants a capability:
- A COOP swap's new group is adopted when the navigation commits, not when the
swap starts, so a
navigation that is cancelled, fails, or becomes a download cannot leave the
page isolated. Until
then, the new WebPage's creation parameters use the provisional page's group.
- Substitute data and custom URL scheme handler loads skip COOP enforcement, so
they start a new
Shared group instead of staying in an isolated one.
- A service worker's response to a subframe navigation now gets the COEP
inheritance check, so a
document that never opted in cannot load in an isolated process.
Also fix Document::crossOriginIsolated() for cross-site subframes. It read
mainFrameDocument(),
which is null when the main frame is remote.
Unskip shared-array-buffers/window-failure.https.html under site isolation. It
timed out because
its cross-site iframe could not create a SharedArrayBuffer.
Tests: TestWebKitAPI.SiteIsolation.CrossOriginIsolatedBrowsingContextGroup*
TestWebKitAPI.SiteIsolation.ProcessesAreNotReusedAfterCrossOriginIsolatedBrowsingContextGroupSwitch
TestWebKitAPI.SiteIsolation.RelatedWebViewDoesNotJoinCrossOriginIsolatedBrowsingContextGroup
* LayoutTests/platform/ios-site-isolation/TestExpectations:
* LayoutTests/platform/mac-site-isolation/TestExpectations:
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::crossOriginIsolated const): Use crossOriginOpenerPolicy(),
which also works when
the main frame is remote.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::doCrossOriginEmbedderPolicyHandlingOfNavigationResponse):
Added.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:
* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp:
(WebKit::ServiceWorkerFetchTask::processResponse): Check COEP inheritance.
* Source/WebKit/UIProcess/API/APIPageConfiguration.cpp:
(API::PageConfiguration::preferredBrowsingContextGroup const): Don't join a
related page's isolated
group.
(API::PageConfiguration::crossOriginMode const): Added.
* Source/WebKit/UIProcess/API/APIPageConfiguration.h:
* Source/WebKit/UIProcess/API/Cocoa/WKProcessPool.mm:
(-[WKProcessPool _crossOriginIsolatedProcessIdentifiersForTesting]): Added.
* Source/WebKit/UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:
(WebKit::BrowsingContextGroup::BrowsingContextGroup):
(WebKit::BrowsingContextGroup::sharedProcessForSite): Return null for an
isolated group.
(WebKit::BrowsingContextGroup::ensureProcessForSite): Assert that the process's
mode matches.
* Source/WebKit/UIProcess/BrowsingContextGroup.h:
(WebKit::BrowsingContextGroup::create):
(WebKit::BrowsingContextGroup::crossOriginMode const): Added.
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::initializeWebPage): Use the identifier of the
group the page will
commit into.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::getOrCreateBrowsingContextGroup):
(WebKit::WebPageProxy::launchProcess): Use the group's mode.
(WebKit::WebPageProxy::suspendCurrentPageIfPossible): Keep the mode on the
placeholder group.
(WebKit::WebPageProxy::browsingContextGroupForNavigation): Drop isolation for
loads that skip COOP
enforcement.
(WebKit::WebPageProxy::triggerBrowsingContextGroupSwitchForNavigation): Create
the group with the
mode, get its process from processForSite(), and adopt the group on commit.
Only reuse the
provisional process for a Shared group.
(WebKit::WebPageProxy::triggerProcessSwapForEnhancedSecurity):
(WebKit::WebPageProxy::createNewPage): Load a blob: URL popup in its own
process when it is not in
the opener's.
* Source/WebKit/UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::tryTakePrewarmedProcess): Match the mode.
(WebKit::WebProcessPool::processForSite): Take the mode, and only reuse
processes, including cached
COOP processes, for Shared.
(WebKit::canShareProcessWithOpener): Match the mode.
(WebKit::WebProcessPool::createWebPage): Use the configuration's mode.
(WebKit::WebProcessPool::crossOriginIsolatedProcessIdentifiers): Added.
(WebKit::WebProcessPool::processForNavigation): Only reuse a back/forward
process with a matching mode.
(WebKit::WebProcessPool::prepareProcessForNavigation): Use the group's mode for
the crash fallback.
(WebKit::WebProcessPool::processForNavigationInternal): Swap when the source
process's mode differs,
and only reuse processes with a matching mode.
* Source/WebKit/UIProcess/WebProcessPool.h: Make createNewWebProcess() private.
* Tools/Scripts/webkitpy/api_tests/allowlist.txt:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::crossOriginIsolationServer):
(TestWebKitAPI::isCrossOriginIsolatedProcess):
(TestWebKitAPI::expectAllProcessesCrossOriginIsolated):
(TestWebKitAPI::processIdentifiers):
(TestWebKitAPI::expectSharedArrayBuffer):
(TestWebKitAPI::expectCrossOriginIsolated):
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupUsesIsolatedProcesses)): Added.
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupUsesIsolatedProcessesForNestedFrames)):
Added.
(TestWebKitAPI::TEST(SiteIsolation,
ProcessesAreNotReusedAfterCrossOriginIsolatedBrowsingContextGroupSwitch)):
Added.
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupDoesNotUseSharedProcess)): Added.
(TestWebKitAPI::TEST(SiteIsolation,
RelatedWebViewDoesNotJoinCrossOriginIsolatedBrowsingContextGroup)): Added.
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupWindowOpen)): Added.
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupNoopenerWindowOpen)): Added.
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupNotAdoptedWhenNavigationIsCancelled)):
Added.
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupAfterCrash)): Added.
(TestWebKitAPI::TEST(SiteIsolation,
CrossOriginIsolatedBrowsingContextGroupAfterBackForwardNavigation)): Added.
Canonical link: https://commits.webkit.org/322609@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
