2002073 - Perma [tier 2] /content-security-policy/inheritance/document-write-iframe.html | document.open() keeps inherited CSPs on empty iframe. - expected TIMEOUT

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Treeherder Bug Filer]

Filed by: sstanca [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=537197255&repo=mozilla-central&task=dP4YrW2eSSimBcTRF6MJ5w.0
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/dP4YrW2eSSimBcTRF6MJ5w/runs/0/artifacts/public/logs/live_backing.log

---

[task 2025-11-24T17:19:45.299+00:00] 17:19:45     INFO - TEST-START | /content-security-policy/inheritance/document-write-iframe.html
[task 2025-11-24T17:19:45.329+00:00] 17:19:45     INFO - Setting pref layout.disable-pixel-alignment to true
[task 2025-11-24T17:19:45.348+00:00] 17:19:45     INFO - Setting pref layout.css.anchor-positioning.enabled to true
[task 2025-11-24T17:19:45.365+00:00] 17:19:45     INFO - Setting pref dom.security.trusted_types.enabled to true
[task 2025-11-24T17:19:45.450+00:00] 17:19:45     INFO - PID 28798 | [Parent 28798, Main Thread] WARNING: NS_ENSURE_TRUE(she && she->mInfo->mSharedState.Get()) failed: file /builds/worker/checkouts/gecko/docshell/shistory/SessionHistoryEntry.cpp:1213
[task 2025-11-24T17:19:45.621+00:00] 17:19:45     INFO - PID 28798 | [Parent 28798, Main Thread] WARNING: NS_ENSURE_TRUE(she && she->mInfo->mSharedState.Get()) failed: file /builds/worker/checkouts/gecko/docshell/shistory/SessionHistoryEntry.cpp:1213
[task 2025-11-24T17:19:45.622+00:00] 17:19:45     INFO - PID 28798 | [Child 29381, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x805E0006 (NS_ERROR_CONTENT_BLOCKED): file /builds/worker/checkouts/gecko/dom/security/nsContentSecurityManager.cpp:1502
[task 2025-11-24T17:19:45.623+00:00] 17:19:45     INFO - PID 28798 | [Child 29381, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:2320
[task 2025-11-24T17:19:45.684+00:00] 17:19:45     INFO - PID 28798 | 1764004785682	Marionette	WARN	Ignoring event 'pageshow' because document has an invalid readyState of 'interactive'.
[task 2025-11-24T17:19:45.729+00:00] 17:19:45     INFO - 
[task 2025-11-24T17:19:45.729+00:00] 17:19:45     INFO - TEST-UNEXPECTED-PASS | /content-security-policy/inheritance/document-write-iframe.html | document.open() keeps inherited CSPs on empty iframe. - expected TIMEOUT
[task 2025-11-24T17:19:45.729+00:00] 17:19:45     INFO - TEST-INFO | expected TIMEOUT
[task 2025-11-24T17:19:45.731+00:00] 17:19:45     INFO - 
[task 2025-11-24T17:19:45.731+00:00] 17:19:45     INFO - TEST-UNEXPECTED-PASS | /content-security-policy/inheritance/document-write-iframe.html | document.open() does not change delivered CSPs. - expected NOTRUN
[task 2025-11-24T17:19:45.731+00:00] 17:19:45     INFO - TEST-INFO | expected NOTRUN
[task 2025-11-24T17:19:45.732+00:00] 17:19:45     INFO - TEST-UNEXPECTED-OK | /content-security-policy/inheritance/document-write-iframe.html | expected TIMEOUT
[task 2025-11-24T17:19:45.732+00:00] 17:19:45     INFO - TEST-INFO expected TIMEOUT | took 430ms
[task 2025-11-24T17:19:45.735+00:00] 17:19:45     INFO - PID 28798 | 1764004785731	Marionette	INFO	Stopped listening on port 42801
[task 2025-11-24T17:19:46.285+00:00] 17:19:46     INFO - PID 28798 | [Parent 28798, Socket Thread] WARNING: cannot post event if not initialized: file /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpConnectionMgr.cpp:233
[task 2025-11-24T17:19:46.381+00:00] 17:19:46     INFO - Browser exited with return code -15
[task 2025-11-24T17:19:46.384+00:00] 17:19:46  WARNING - Firefox didn't exit cleanly, not processing leak logs
[task 2025-11-24T17:19:46.385+00:00] 17:19:46     INFO - Closing logging queue
[task 2025-11-24T17:19:46.385+00:00] 17:19:46     INFO - queue closed

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 543435

:vhilla, since you are the author of the regressor, bug 543435, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Intermittent Failures Robot]

17 failures were associated with this bug yesterday.

Repository breakdown:

• mozilla-central: 17

Table

	nav	no_variant	nofis
android-x86/opt			2
linux2404-x86_64/debug	2	7
linux2404-x86_64/opt		2
macosx1470-x86_64/opt		2
windows11-x86_64/opt		2

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=2002073&startday=2025-11-24&endday=2025-11-24&tree=all

Comment 3

[Vincent Hilla [:vhilla]]

--- a/testing/web-platform/tests/content-security-policy/inheritance/document-write-iframe.html
+++ b/testing/web-platform/tests/content-security-policy/inheritance/document-write-iframe.html
@@ -36,6 +36,7 @@
     promise_test(async () => {
       let iframe = document.createElement('iframe');
       document.body.appendChild(iframe);
+      await new Promise(resolve => iframe.onload = resolve);
 
       let msg = message_from(iframe.contentWindow);
       let doc = iframe.contentWindow.document;

With that change, i.e. waiting for the iframe to load, the test also passes pre bug 543435. So we can just update the expectations given sync-about-blank means the iframe will now be loaded.

I wonder whether there should be a test explicitly for the case where the about:blank is transient.

Comment 4

[Vincent Hilla [:vhilla]]

Attachment: Bug 2002073 - Update expectations for CSP document-write-iframe.html. r=#dom-core

Comment 5

[Vincent Hilla [:vhilla]]

Attachment: Bug 2002073 - Test CSP inheritance with document.open() separately for the initial loaded vs transient document. r=#dom-core

The initial document might behave differently depending on whether it has
loaded or is transient. Before bug 543435, Gecko would have passed the first,
but not the third subtest.

Comment 6

[Intermittent Failures Robot]

15 failures were associated with this bug yesterday.

Repository breakdown:

• mozilla-central: 11
• try: 4

Table

	nav	no_variant	nofis
android-x86/opt			1
linux2404-x86_64/debug	4	4
linux2404-x86_64/opt		2
macosx1470-x86_64/opt		2
windows11-x86_64/opt		2

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=2002073&startday=2025-11-25&endday=2025-11-25&tree=all

Comment 7

[Vincent Hilla [:vhilla]]

Fixed by bug 2001842

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/042c73176b63
https://hg.mozilla.org/integration/autoland/rev/d81b31e96b4e
Test CSP inheritance with document.open() separately for the initial loaded vs transient document. r=dom-core,smaug

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/56297 for changes under testing/web-platform/tests

Comment 10

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/d81b31e96b4e

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 12

[Intermittent Failures Robot]

32 failures were associated with this bug in the last 7 days.

This failure happened more than 30 times this week! Resolving this bug is a high priority.

Try to resolve this bug as soon as possible. If unresolved for 2 weeks, the affected test(s) may be disabled.

Repository breakdown:

• mozilla-central: 28
• try: 4

Table

	no_variant	nofis
android-x86/opt		3
linux2404-x86_64/debug	17
linux2404-x86_64/opt	4
macosx1470-x86_64/opt	4
windows11-x86_64/opt	4

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=2002073&startday=2025-11-24&endday=2025-11-30&tree=all