Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4125faf7b550b3e154b2718f2c6267ce161ca8da
https://github.com/WebKit/WebKit/commit/4125faf7b550b3e154b2718f2c6267ce161ca8da
Author: Anthony Tarbinian <[email protected]>
Date: 2026-10-05 (Mon, 05 Oct 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-nested-expected.txt
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-nested.html
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-then-cross-site-nested-expected.txt
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-then-cross-site-nested.html
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-cross-site-parent-expected.txt
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-cross-site-parent.html
A
LayoutTests/http/tests/site-isolation/resources/frame-geometry-child-same-site-with-cross-site-grandchild.html
A
LayoutTests/http/tests/site-isolation/resources/frame-geometry-child-same-site.html
A
LayoutTests/http/tests/site-isolation/resources/frame-geometry-grandchild-with-cross-site-child.html
A
LayoutTests/http/tests/site-isolation/resources/frame-geometry-scrolled-child-cross-site.html
M LayoutTests/platform/ios/TestExpectations
M Source/WebCore/platform/ScrollView.cpp
Log Message:
-----------
[Site Isolation] Advertisement iframes may not load
https://bugs.webkit.org/show_bug.cgi?id=325695
rdar://168599434
Reviewed by Mike Wyrzykowski.
On iOS, the entire page isn't painted all the time. Only what is on
screen is painted. With site isolation, a cross-site iframe's process
doesn't know where it is on the page, so the parent frame's process
tells it how much of it is on screen (this is called a frame's exposed
rect).
ScrollView::exposedContentRect() computes a subframe's exposed rect by
passing its same-process parent's exposed rect to rootViewToContents(),
which expects root view coordinates. That is only correct when the
parent is the top-most frame view in the process. This is because top-most
parent in the process gets told its exposedContentRect from its parent's
remote parent frame (the grandparent of our original child) in
Page::syncLocalFrameInfoToRemote and is received in
WebPage::updateChildFrameVisibleRectsFromParent.
These coordiantes come in as view coordinates, so they don't need to be
fixed up
When the parent is itself a subframe, its exposed rect is in its contents
coordinates, so the result is offset by the parent's position and usually
clipped to nothing. A cross-site iframe nested under two or more same-site
iframes, which is common with ads, is then sent an empty exposed rect and
paints nothing.
main frame
└─ A (same-site iframe)
└─ B (same-site iframe)
└─ C (cross-site iframe, other process)
B interprets A's exposed rect as if (0,0) were the root view's top-left
corner instead of A's, so the rect is misplaced by A's position in the
root view. After clipping to B's bounds, B's exposed rect is too small
or empty. The main frame's process intersects C's visible area with it
and sends the result to C's process, so C paints partially or not at
all.
This patch fixes this by converting the parent's exposed rect to root view
coordinates first, unless the parent is the top-most frame view in the
process, whose exposed rect is already in root view coordinates. See
the paragraphs above on why the top-most frame in a process already
are in view coordinates.
Tests: http/tests/site-isolation/ios/exposed-content-rect-same-site-nested.html
http/tests/site-isolation/ios/exposed-content-rect-same-site-then-cross-site-nested.html
http/tests/site-isolation/ios/exposed-content-rect-scrolled-cross-site-parent.html
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-nested-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-nested.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/frame-geometry-child-same-site.html:
Added.
* LayoutTests/platform/ios/TestExpectations:
* Source/WebCore/platform/ScrollView.cpp:
(WebCore::ScrollView::exposedContentRect const):
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-cross-site-parent-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-cross-site-parent.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/frame-geometry-grandchild-with-cross-site-child.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/frame-geometry-scrolled-child-cross-site.html:
Added.
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-then-cross-site-nested-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-same-site-then-cross-site-nested.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/frame-geometry-child-same-site-with-cross-site-grandchild.html:
Added.
Canonical link: https://commits.webkit.org/322724@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
