Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f5dde6c46e8133c378e3af1916863b840b44425b
https://github.com/WebKit/WebKit/commit/f5dde6c46e8133c378e3af1916863b840b44425b
Author: Cole Carley <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent-expected.txt
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent-paint-expected.html
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent-paint.html
A
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent.html
A
LayoutTests/http/tests/site-isolation/resources/frame-geometry-green-frame.html
A
LayoutTests/http/tests/site-isolation/resources/frame-geometry-scrolled-child-same-site-with-green-grandchild.html
A
LayoutTests/http/tests/site-isolation/resources/frame-geometry-scrolled-child-same-site.html
M LayoutTests/platform/ios/TestExpectations
M Source/WebCore/Headers.cmake
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/platform/ScrollView.cpp
M Source/WebCore/platform/ScrollView.h
A Source/WebCore/platform/graphics/ViewCoordinateSpaceRect.h
Log Message:
-----------
[Site Isolation] Cross-site iframes inside a scrolled same-site iframe get a
clipped exposed rect
https://bugs.webkit.org/show_bug.cgi?id=326583
rdar://189344645
Reviewed by Ben Nham.
ScrollView::exposedContentRect() computes a subframe's exposed rect in its
contents coordinates, then clips it to boundsRect(). boundsRect() is
(0, 0, width, height) in view coordinates, so when the subframe is scrolled,
the clip keeps a region above the visible area instead of the visible area.
Page::syncLocalFrameInfoToRemote() intersects each cross-site child with this
rect, so a cross-site iframe in the scrolled-to region of a same-site iframe
is sent an empty exposed rect and doesn't paint on iOS.
This was found by adding ViewCoordinateSpaceRect, a wrapper that tags a rect
with the
coordinate space it is in, and adopting it in exposedContentRect(). Once the
exposed rect was typed as being in contents space, boundsRect() could not be
intersected with it without saying which space boundsRect() is in, which
exposed the mismatch. The fix converts boundsRect() from view to contents
coordinates.
ViewCoordinateSpaceRect has the same layout as the rect it wraps, so the tag
has no
runtime cost.
Tests:
http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent-paint.html
http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent.html
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent-paint-expected.html:
Added.
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent-paint.html:
Added.
*
LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-scrolled-same-site-parent.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/frame-geometry-green-frame.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/frame-geometry-scrolled-child-same-site-with-green-grandchild.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/frame-geometry-scrolled-child-same-site.html:
Added.
* LayoutTests/platform/ios/TestExpectations:
* Source/WebCore/Headers.cmake:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/platform/ScrollView.cpp:
(WebCore::ScrollView::exposedContentRect const):
* Source/WebCore/platform/ScrollView.h:
(WebCore::ScrollView::contentsToRootView const):
(WebCore::ScrollView::rootViewToContents const):
(WebCore::ScrollView::viewToContents const):
* Source/WebCore/platform/graphics/ViewCoordinateSpaceRect.h: Added.
(WebCore::ViewCoordinateSpaceRect::ViewCoordinateSpaceRect):
(WebCore::ViewCoordinateSpaceRect::raw const):
(WebCore::ViewCoordinateSpaceRect::intersect):
(WebCore::inViewSpace):
(WebCore::inContentsSpace):
(WebCore::inRootViewSpace):
Canonical link: https://commits.webkit.org/323151@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
