Closed Bug 1563629 Opened 7 months ago Closed 6 months ago

[fission] Private Browsing bit incorrectly propagated into OOP iframes

Categories

(Core :: DOM: Content Processes, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla70
Fission Milestone M4
Tracking Status
firefox70 --- fixed

People

(Reporter: Nika, Assigned: kashav)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Currently when we set up an OOP iframe, we don't correctly set up the TabContext which is used to create the BrowserParent actor. Instead, we make up some values which usually work out: https://searchfox.org/mozilla-central/rev/040aa667f419932adf425d92c7438f03230ad96b/dom/ipc/BrowserBridgeParent.cpp#41-48

This bit not being set correctly can cause content crashes when things like postMessage are sent between two out-of-process frames which are same-origin to one another, due to them being confused about the state of the private browsing bit.

We should be correctly setting these values. There are 5 arguments to SetTabContext which need to be inherited or set:

  • aIsMozBrowserElement: We don't intend to support this with Fission currently, so we can probably leave this as false
  • aChromeOuterWindowId: We can inherit this from our Manager()->ChromeOuterWindowId()
  • aShowFocusRings: It looks like this comes from the root window, so let's inherit it too.
  • aOriginAttributes: The attributes we set on this don't change for subframes, so let's inherit this.
  • aPresentationURL: This is already passed in as an argument, so let's keep using that value.

This should ideally set up the origin attributes used in the content process more accurately.

Fission Milestone: --- → M4
Duplicate of this bug: 1561205
Pushed by kmadan@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/868f8b46631b
Inherit TabContext values from the current BrowserParent, r=nika,kmag
Status: NEW → RESOLVED
Closed: 6 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
You need to log in before you can comment on or make changes to this bug.