Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bf92727c9d359309c2a437a3b0f93d83e1fed73f
https://github.com/WebKit/WebKit/commit/bf92727c9d359309c2a437a3b0f93d83e1fed73f
Author: Anne van Kesteren <[email protected]>
Date: 2026-10-04 (Sun, 04 Oct 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/cross-origin-isolated-permission-iframe.https.window-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-domain-failure.https.sub-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-domain-failure.https.sub.html
M
LayoutTests/imported/w3c/web-platform-tests/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-failure.https.html
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/Document.h
M Source/WebCore/dom/ScriptExecutionContext.h
M Source/WebCore/html/PermissionsPolicy.cpp
M Source/WebCore/html/PermissionsPolicy.h
M Source/WebCore/page/LocalDOMWindow.cpp
M Source/WebCore/page/LocalDOMWindow.h
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
Implement the cross-origin-isolated permissions policy feature
https://bugs.webkit.org/show_bug.cgi?id=326255
rdar://189124490
Reviewed by Chris Dumez.
A document's cross-origin isolated capability requires both that its agent
cluster is cross-origin isolated and that the document is allowed to use the
"cross-origin-isolated" feature, whose default allowlist is 'self'. We did not
implement the feature, so every cross-origin iframe in a cross-origin isolated
page reported crossOriginIsolated as true and could serialize
SharedArrayBuffers, without the embedder delegating that capability through
allow="cross-origin-isolated".
We do not support the Permissions-Policy header, so the subtests that rely on
it to disable the feature remain failures.
Update window-failure.https.html from upstream, which delegates the capability
to its cross-site iframe so the failure is due to the agent cluster mismatch.
Do the same for the cross-site iframe in the API test added in 322609@main.
window-domain-failure.https.sub.html expected SharedArrayBuffer to be absent in
a cross-origin iframe of a cross-origin isolated page. HTML only removes it
when the agent cluster's cross-origin isolation mode is "none", which is not
the case there, so it now expects it to be present. In particular the capability
is not a factor.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Canonical link: https://commits.webkit.org/322663@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
