Closed Bug 1656627 Opened 6 months ago Closed 5 months ago

[wpt-sync] Sync PR 24616 - Origin isolation: a new strategy for window.originIsolationRestricted

Categories

(Testing :: web-platform-tests, task, P4)

task

Tracking

(firefox81 fixed)

RESOLVED FIXED
81 Branch
Tracking Status
firefox81 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

()

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 24616 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/24616
Details from upstream follow.

Domenic Denicola <domenic@chromium.org> wrote:

Origin isolation: a new strategy for window.originIsolationRestricted

In https://chromium-review.googlesource.com/c/chromium/src/+/2243994 I
introduced an implementation for window.originIsolationRestricted which
pipes the isolation state from NavigationRequest to the navigated-to
LocalDOMWindow. However, this does not work for the case of the initial
about:blank, where no navigation is performed. Furthermore, it does not
match the spec, where the Window property just reflects an agent
cluster-wide property.

This CL introduces an alternate approach, more similar to what is done
for self.crossOriginIsolated in
https://chromium-review.googlesource.com/c/chromium/src/+/2247463, which
is another agent cluster-wide value. The origin isolation state is
stored in the renderer-side Agent class. Then the LocalDOMWindow getter
can just pick it up from the surrounding agent, as in the spec. Note
that unlike the implementation for self.crossOriginIsolated, the value
is per-Agent instead of static (process-wide).

Currently the value is set several times per agent (roughly once on
every navigation). This is redundant, but we don't yet have a good place
to set it once (i.e., we don't have a browser-side "time of agent
creation"). If that gets fixed, we can likely stop piping the value
through navigation params. See
https://docs.google.com/document/d/1MTnmyWAoAIKDH4yWaRthIUdi05MsjlML8gctvKP7-h8/edit
for discussions around fixing that.

This fixes the issue with about:blank iframes embedded in origin-isolated
pages reporting false, because the agent's origin-isolated boolean was
previously set to true by the containing frame.

This does not yet fix the issue with data: URLs reporting false, tested in
external/wpt/origin-isolation/getter-special-cases/data-url.https.html.
However, that will be doable as a followup, by changing the
navigation-time computation to pass true for them instead of false.
(Currently it passes false because data: URLs don't get their own
process, but it should pass true because they do get their own agent
cluster.)

Bug: 1095653
Change-Id: I8dfa8fc4a4766efc0611d43a255673662c422776
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2300237
Commit-Queue: Domenic Denicola \<domenic@chromium.org>
Reviewed-by: Charlie Reis \<creis@chromium.org>
Reviewed-by: Daniel Cheng \<dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#793799}

CI Results

Ran 0 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests and 9 subtests

Status Summary

Firefox

ERROR : 1
NOTRUN: 9

Chrome

OK : 1
PASS : 8
FAIL : 1

Safari

OK : 1
PASS : 2
FAIL : 7

Links

GitHub PR Head
GitHub PR Base

Details

Firefox-only Failures

/origin-isolation/about-blank.https.sub.html: ERROR
parent to about:blank: setting document.domain must give sync access: NOTRUN
parent to about:blank: message event must occur: NOTRUN

New Tests That Don't Pass

/origin-isolation/about-blank.https.sub.html: ERROR (Chrome: OK, Safari: OK)
about:blank to child2: messageerror event must occur: NOTRUN (Chrome: PASS, Safari: FAIL)
about:blank: originIsolationRestricted must equal true: NOTRUN (Chrome: FAIL, Safari: FAIL)
parent to about:blank: setting document.domain must give sync access: NOTRUN (Chrome: PASS, Safari: PASS)
parent: originIsolationRestricted must equal true: NOTRUN (Chrome: PASS, Safari: FAIL)
parent to about:blank: message event must occur: NOTRUN (Chrome: PASS, Safari: PASS)
about:blank to child2: setting document.domain must not give sync access: NOTRUN (Chrome: PASS, Safari: FAIL)
child2: originIsolationRestricted must equal false: NOTRUN (Chrome: PASS, Safari: FAIL)
child2 to about:blank: setting document.domain must not give sync access: NOTRUN (Chrome: PASS, Safari: FAIL)
child2 to about:blank: messageerror event must occur: NOTRUN (Chrome: PASS, Safari: FAIL)

Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6c1a6a0a8f4e
[wpt PR 24616] - Origin isolation: a new strategy for window.originIsolationRestricted, a=testonly
https://hg.mozilla.org/integration/autoland/rev/613c0c5a1fdc
[wpt PR 24616] - Update wpt metadata, a=testonly
Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/34d81d3d23d1
[wpt PR 24616] - Origin isolation: a new strategy for window.originIsolationRestricted, a=testonly
https://hg.mozilla.org/integration/autoland/rev/0ab4139f3905
[wpt PR 24616] - Update wpt metadata, a=testonly
Status: NEW → RESOLVED
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch
You need to log in before you can comment on or make changes to this bug.