1685475 - Data documents should belong to the same DocGroup when it's creator is in the cross-origin-isolated env

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Tom Tung [:tt, :ttung]]

https://searchfox.org/mozilla-central/rev/ef900cd2258d4c5d968093f612f807d96e6e7c98/dom/base/Document.cpp#7042-7044
If the document is a data document, then it isn't bound to any browsing context. Such that this would cause it to belong to a different DocGroup from its creator if its creator is in a cross-origin-isolated env.

We should probably move the cross-origin-isolated state from browsing context to Docgroup to resolve this issue.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

I'm investigating if this could lead to a security bug with another bug. Neither of them alone should trigger security issue.

Comment 2

[Anne (:annevk)]

(For clarity, in the specification we track this state on the browsing context group and from there it is copied to be on the agent clusters associated with that browsing context group. Docgroup roughly corresponds to an agent within that agent cluster. Dedicated workers make up the other agents. It's different for shared/service workers but we don't implement this there yet.)

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

(I think there isn't a security issue because the other bug is protected by release asserts)

Comment 4

[Tom Tung [:tt, :ttung]]

Attachment: Bug 1685475 - Get cross-origin-isolated state from the scope object when it's a data document and thus don't have a browsing context;

Comment 5

[Tom Tung [:tt, :ttung]]

Attachment: Bug 1685475 - Add a browser test to verify data document stays in the same DocGroup with its creator;

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Possible Gecko specific testcase

Comment 7

[Tom Tung [:tt, :ttung]]

try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=60cadb9d228828f98674d924d98b8b9b0373ae85

Comment 8

[Tom Tung [:tt, :ttung]]

Discuss this with Olli, this bug is not a security bug. (It might be but proved to be not after all). I am going to remove the keyword and move it out from the group.

Comment 9

[Tom Tung [:tt, :ttung]]

(In reply to Tom Tung [:tt, :ttung] from comment #8)

Discuss this with Olli, this bug is not a security bug. (It might be but proved to be not after all). I am going to remove the keyword and move it out from the group.

Actually, it seems I don't have permission to remove it from the group.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bb58a378493a
Get cross-origin-isolated state from the scope object when it's a data document and thus don't have a browsing context; r=smaug
https://hg.mozilla.org/integration/autoland/rev/fef805bdd35c
Add a browser test to verify data document stays in the same DocGroup with its creator; r=smaug

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/bb58a378493a
https://hg.mozilla.org/mozilla-central/rev/fef805bdd35c