Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 772701bae9c5a854a774f4dde7416235fa8c8e6d
https://github.com/WebKit/WebKit/commit/772701bae9c5a854a774f4dde7416235fa8c8e6d
Author: Anne van Kesteren <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
R LayoutTests/fast/web-share/share-canShare-insecure-expected.txt
R LayoutTests/fast/web-share/share-canShare-insecure.html
R
LayoutTests/http/tests/events/device-orientation-motion-insecure-context-expected.txt
R
LayoutTests/http/tests/events/device-orientation-motion-insecure-context.html
R
LayoutTests/http/tests/events/device-orientation-motion-non-secure-context-expected.txt
R
LayoutTests/http/tests/events/device-orientation-motion-non-secure-context.html
R
LayoutTests/http/tests/is-logged-in/unavailable-in-insecure-contexts-expected.txt
R LayoutTests/http/tests/is-logged-in/unavailable-in-insecure-contexts.html
R LayoutTests/http/tests/misc/gamepads-insecure-expected.txt
R LayoutTests/http/tests/misc/gamepads-insecure.html
R
LayoutTests/http/tests/notifications/notification-in-non-secure-context-expected.txt
R
LayoutTests/http/tests/notifications/notification-in-non-secure-context.html
R LayoutTests/http/tests/security/insecure-geolocation-expected.txt
R LayoutTests/http/tests/security/insecure-geolocation.html
R
LayoutTests/http/tests/security/resources/geolocation-over-insecure-content.html
R
LayoutTests/http/tests/workers/resources/worker-iframe-owner-isSecureContext-frame.html
R
LayoutTests/http/tests/workers/resources/worker-iframe-owner-isSecureContext-worker.js
R
LayoutTests/http/tests/workers/worker-iframe-owner-isSecureContext-expected.txt
R LayoutTests/http/tests/workers/worker-iframe-owner-isSecureContext.html
R
LayoutTests/http/wpt/cross-origin-opener-policy/non-secure-to-secure-context-navigation.https-expected.txt
R
LayoutTests/http/wpt/cross-origin-opener-policy/non-secure-to-secure-context-navigation.https.html
R
LayoutTests/http/wpt/cross-origin-opener-policy/resources/non-secure-to-secure-context-navigation-popup.html
R LayoutTests/http/wpt/crypto/historical-expected.txt
R LayoutTests/http/wpt/crypto/historical.html
A LayoutTests/http/wpt/gamepad/getGamepads-insecure-context-expected.txt
A LayoutTests/http/wpt/gamepad/getGamepads-insecure-context.html
A LayoutTests/http/wpt/geolocation/insecure-geolocation-expected.txt
A LayoutTests/http/wpt/geolocation/insecure-geolocation.html
A
LayoutTests/http/wpt/geolocation/resources/geolocation-over-insecure-content.html
A
LayoutTests/http/wpt/is-logged-in/unavailable-in-insecure-contexts-expected.txt
A LayoutTests/http/wpt/is-logged-in/unavailable-in-insecure-contexts.html
R LayoutTests/http/wpt/mediastream/speechrecognition-insecure-expected.txt
R LayoutTests/http/wpt/mediastream/speechrecognition-insecure.html
M LayoutTests/imported/w3c/resources/import-expectations.json
A
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/non-secure-to-secure-context-navigation.https-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/non-secure-to-secure-context-navigation.https.html
A
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resources/non-secure-to-secure-context-navigation-popup.html
M
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resources/w3c-import.log
M
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-opener-policy/w3c-import.log
A
LayoutTests/imported/w3c/web-platform-tests/orientation-event/device-orientation-events-unavailable-on-insecure-origins-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/orientation-event/device-orientation-events-unavailable-on-insecure-origins.html
A
LayoutTests/imported/w3c/web-platform-tests/orientation-event/resources/orientation-event-helpers.js
A
LayoutTests/imported/w3c/web-platform-tests/orientation-event/resources/w3c-import.log
A
LayoutTests/imported/w3c/web-platform-tests/orientation-event/w3c-import.log
A
LayoutTests/imported/w3c/web-platform-tests/speech-api/SpeechRecognition-non-secure-context.http-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/speech-api/SpeechRecognition-non-secure-context.http.html
M LayoutTests/imported/w3c/web-platform-tests/speech-api/w3c-import.log
R
LayoutTests/platform/ios/http/tests/events/device-orientation-motion-insecure-context-expected.txt
R
LayoutTests/platform/ios/http/tests/events/device-orientation-motion-non-secure-context-expected.txt
M LayoutTests/platform/win/TestExpectations
M Source/WebCore/dom/Document.h
M Source/WebCore/page/SecurityOrigin.h
M Source/WebCore/testing/Internals.cpp
M Source/WebCore/testing/Internals.h
M Source/WebCore/testing/Internals.idl
Log Message:
-----------
Remove internals.markContextAsInsecure()
https://bugs.webkit.org/show_bug.cgi?id=326672
rdar://189407926
Reviewed by Chris Dumez.
internals.markContextAsInsecure() turned a document created as a secure
context into a non-secure one, which cannot happen otherwise: an API that
requires a secure context is either exposed or not. It also changed state only
in its own process, so with site isolation other processes still saw a secure
context.
Tests now get a real non-secure context from the WPT server, as localhost is
potentially trustworthy. Tests that need nothing WebKit-specific become
web-platform tests:
-
orientation-event/device-orientation-events-unavailable-on-insecure-origins.html
is imported and replaces http/tests/events/device-orientation-motion-*.
- speech-api/SpeechRecognition-non-secure-context.http.html is new and replaces
http/wpt/mediastream/speechrecognition-insecure.html.
SpeechRecognitionResultList is still exposed in non-secure contexts.
-
html/cross-origin-opener-policy/non-secure-to-secure-context-navigation.https.html
moves from http/wpt. Its popup now starts at
get_host_info().UNAUTHENTICATED_ORIGIN and navigates itself to the secure
page.
The tests for the login status API, getGamepads() and geolocation's console
message move to http/wpt and run from get_host_info().UNAUTHENTICATED_ORIGIN.
The login status test now checks navigator.setStatus() and
navigator.isLoggedIn() instead of navigator.setLoggedIn(), which no longer
exists.
Four tests are removed, as imported WPTs already cover them from a non-secure
context:
- fast/web-share/share-canShare-insecure.html, by
web-share/canShare-insecure.http.html
and web-share/share-securecontext.http.html.
- http/tests/notifications/notification-in-non-secure-context.html, by
notifications/permissions-non-secure.html.
- http/tests/workers/worker-iframe-owner-isSecureContext.html, by
secure-contexts/basic-dedicated-worker.html.
- http/wpt/crypto/historical.html, by WebCryptoAPI/historical.any.html.
This also removes the SecurityOrigin and Document setters that only the hook
used.
Canonical link: https://commits.webkit.org/323118@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
