230428 2021-09-17 13:57:44 -0700 [ MacOS ] http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html is a flakey failure 2022-03-16 11:44:00 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=222748 InRadar P2 Normal --- 1 ayumi_kojima katherine_cheney bfulgham ews-watchlist katherine_cheney mkwst webkit-bot-watchers-bugzilla webkit-bug-importer oldest_to_newest 1794599 0 ayumi_kojima 2021-09-17 13:57:44 -0700 http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html Is a flaky failure on macOS. It is a flaky failure/timeout on iOS. The test has been flaky on macOS Debug (bug 222748), but now it is flaky on both Release and Debug. History: https://results.webkit.org/?suite=layout-tests&test=http%2Ftests%2Fsecurity%2FcontentSecurityPolicy%2Fframe-src-cross-origin-load.html Result page: https://build.webkit.org/results/Apple-BigSur-Release-WK1-Tests/r282556%20(5339)/results.html Diff: --- /Volumes/Data/worker/bigsur-release-tests-wk1/build/layout-test-results/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt +++ /Volumes/Data/worker/bigsur-release-tests-wk1/build/layout-test-results/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-actual.txt @@ -1,6 +1,6 @@ CONSOLE MESSAGE: Refused to load https://localhost:8443/security/contentSecurityPolicy/resources/alert-fail.html because it does not appear in the frame-src directive of the Content Security Policy. +CONSOLE MESSAGE: PASS ALERT: PASS -CONSOLE MESSAGE: PASS IFrames blocked by CSP should generate a 'load' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS. On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". 1794600 1 webkit-bug-importer 2021-09-17 13:58:14 -0700 <rdar://problem/83254559> 1794608 2 ayumi_kojima 2021-09-17 14:13:58 -0700 For iOS, the test is mostly flaky on Release, but I see it timed out on Debug one time. Market test expectations: https://trac.webkit.org/changeset/282692/webkit 1804529 3 ayumi_kojima 2021-10-14 14:58:02 -0700 I don't see timeouts any more on the recent results. Also, the flaky failure is only seen on macOS (mainly wk1). I was not able to reproduce the failure locally on BigSure using run-webkit-tests -debug -1 --force --iterations 1000 --exit-after-n-failures 1 --exit-after-n-crashes-or-timeouts 1 http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html -f 1804532 4 ayumi_kojima 2021-10-14 15:05:15 -0700 Removed test expectation for iOS https://trac.webkit.org/changeset/284200/webkit 1851093 5 454641 katherine_cheney 2022-03-14 17:38:27 -0700 Created attachment 454641 Patch 1851895 6 454641 bfulgham 2022-03-16 10:55:22 -0700 Comment on attachment 454641 Patch Nice solution! r=me 1851911 7 ews-feeder 2022-03-16 11:43:55 -0700 Committed r291359 (248491@main): <https://commits.webkit.org/248491@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 454641. 454641 2022-03-14 17:38:27 -0700 2022-03-16 11:43:58 -0700 Patch bug-230428-20220314173826.patch text/plain 5463 katherine_cheney U3VidmVyc2lvbiBSZXZpc2lvbjogMjkxMTM3CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9DaGFu Z2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggMGVkZmJiYjYyNzdkYjQ4NDUzM2Ix NjdmY2I1MjUzOWMyOGY0OTBkYy4uNDY3OTI0Yjk4OTVkMDllYzhiOWY0YmIyODE3MTc0NGU2Y2Yw ZDAwMCAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3Rz L0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDIyLTAzLTE0ICBLYXRlIENoZW5leSAgPGth dGhlcmluZV9jaGVuZXlAYXBwbGUuY29tPgorCisgICAgICAgIFsgTWFjT1MgXSBodHRwL3Rlc3Rz L3NlY3VyaXR5L2NvbnRlbnQgU2VjdXJpdHlQb2xpY3kvZnJhbWUtc3JjLWNyb3NzLW9yaWdpbi1s b2FkLmh0bWwgaXMgYSBmbGFrZXkgZmFpbHVyZSAoMjMwNDI4KQorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjMwNDI4CisgICAgICAgIDxyZGFyOi8vcHJv YmxlbS84MzI1NDU1OT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBUaGUgZmxha2luZXNzIHdhcyBjYXVzZWQgYnkgcmVseWluZyBvbiBvcmRlcmVkIG91 dHB1dCBmcm9tIGlmcmFtZQorICAgICAgICBsb2FkcyB0aGF0IGFyZSBub3QgZ3VhcmFudGVlZCB0 byBsb2FkIGluIG9yZGVyLiBUaGlzIGNoYW5nZSBsb2FkcworICAgICAgICBpZnJhbWVzIGluIHNj cmlwdCB0byBtYWtlIHN1cmUgdGhleSBsb2FkIG9ubHkgYWZ0ZXIgdGhlIHByZXZpb3VzCisgICAg ICAgIGlmcmFtZSBoYXMgbG9hZGVkLgorCisgICAgICAgICogaHR0cC90ZXN0cy9zZWN1cml0eS9j b250ZW50U2VjdXJpdHlQb2xpY3kvZnJhbWUtc3JjLWNyb3NzLW9yaWdpbi1sb2FkLWV4cGVjdGVk LnR4dDoKKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGlj eS9mcmFtZS1zcmMtY3Jvc3Mtb3JpZ2luLWxvYWQuaHRtbDoKKyAgICAgICAgKiBwbGF0Zm9ybS9t YWMvVGVzdEV4cGVjdGF0aW9uczoKKwogMjAyMi0wMy0xMCAgTWF0dGVvIEZsb3JlcyAgPG1hdHRl b19mbG9yZXNAYXBwbGUuY29tPgogCiAgICAgICAgIFsgaU9TIE1hYyBdIGltcG9ydGVkL3czYy93 ZWItcGxhdGZvcm0tdGVzdHMvc2VydmljZS13b3JrZXJzL3NlcnZpY2Utd29ya2VyL3BhcnRpdGlv bmVkLXNlcnZpY2Utd29ya2VyLW1hdGNoQWxsLnRlbnRhdGl2ZS5odHRwcy5odG1sIGlzIGEgZmxh a3kgdGV4dCBmYWlsdXJlIG9uIGFsbCBxdWV1ZXMKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L2ZyYW1lLXNyYy1jcm9zcy1v cmlnaW4tbG9hZC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5 L2NvbnRlbnRTZWN1cml0eVBvbGljeS9mcmFtZS1zcmMtY3Jvc3Mtb3JpZ2luLWxvYWQtZXhwZWN0 ZWQudHh0CmluZGV4IDcxNjA1NDhmNmM3YTJhOTFlNjFiMTI3MzQ4MGQ1YTZiOGNmOGUzOGQuLmM4 N2FjOGY2ZDE5ZGM2NmZjMThjOGRlZDcyNGZlNDk5NWIyNjA1ZmUgMTAwNjQ0Ci0tLSBhL0xheW91 dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L2ZyYW1lLXNy Yy1jcm9zcy1vcmlnaW4tbG9hZC1leHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90 ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvZnJhbWUtc3JjLWNyb3NzLW9yaWdp bi1sb2FkLWV4cGVjdGVkLnR4dApAQCAtMSw1ICsxLDUgQEAKLUNPTlNPTEUgTUVTU0FHRTogUmVm dXNlZCB0byBsb2FkIGh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvc2VjdXJpdHkvY29udGVudFNlY3Vy aXR5UG9saWN5L3Jlc291cmNlcy9hbGVydC1mYWlsLmh0bWwgYmVjYXVzZSBpdCBkb2VzIG5vdCBh cHBlYXIgaW4gdGhlIGZyYW1lLXNyYyBkaXJlY3RpdmUgb2YgdGhlIENvbnRlbnQgU2VjdXJpdHkg UG9saWN5LgogQUxFUlQ6IFBBU1MKK0NPTlNPTEUgTUVTU0FHRTogUmVmdXNlZCB0byBsb2FkIGh0 dHBzOi8vbG9jYWxob3N0Ojg0NDMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3Jlc291 cmNlcy9hbGVydC1mYWlsLmh0bWwgYmVjYXVzZSBpdCBkb2VzIG5vdCBhcHBlYXIgaW4gdGhlIGZy YW1lLXNyYyBkaXJlY3RpdmUgb2YgdGhlIENvbnRlbnQgU2VjdXJpdHkgUG9saWN5LgogQ09OU09M RSBNRVNTQUdFOiBQQVNTCiBJRnJhbWVzIGJsb2NrZWQgYnkgQ1NQIHNob3VsZCBnZW5lcmF0ZSBh ICdsb2FkJyBldmVudCwgcmVnYXJkbGVzcyBvZiBibG9ja2VkIHN0YXRlLiBUaGlzIG1lYW5zIHRo ZXkgYXBwZWFyIHRvIGJlIG5vcm1hbCBjcm9zcy1vcmlnaW4gbG9hZHMsIHRoZXJlYnkgbm90IGxl YWtpbmcgVVJMIGluZm9ybWF0aW9uIGRpcmVjdGx5IHRvIEpTLgogCmRpZmYgLS1naXQgYS9MYXlv dXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9mcmFtZS1z cmMtY3Jvc3Mtb3JpZ2luLWxvYWQuaHRtbCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJp dHkvY29udGVudFNlY3VyaXR5UG9saWN5L2ZyYW1lLXNyYy1jcm9zcy1vcmlnaW4tbG9hZC5odG1s CmluZGV4IDFkZjBkYWNiOTVmZDA5MjlkYzM2Mjg5MWQ2NDdkYzY3ZjQ3ODM2MGMuLjQyNmQ1Zjg2 OGRkNzJlY2FjNTgwODRjY2ZiYTQyMGUxMzU4ZWQzYWIgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3Rz L2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L2ZyYW1lLXNyYy1jcm9z cy1vcmlnaW4tbG9hZC5odG1sCisrKyBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkv Y29udGVudFNlY3VyaXR5UG9saWN5L2ZyYW1lLXNyYy1jcm9zcy1vcmlnaW4tbG9hZC5odG1sCkBA IC04LDIwICs4LDM0IEBACiAgICAgICAgIAogICAgICAgICBkZXNjcmlwdGlvbigiSUZyYW1lcyBi bG9ja2VkIGJ5IENTUCBzaG91bGQgZ2VuZXJhdGUgYSAnbG9hZCcgZXZlbnQsIHJlZ2FyZGxlc3Mg b2YgYmxvY2tlZCBzdGF0ZS4gVGhpcyBtZWFucyB0aGV5IGFwcGVhciB0byBiZSBub3JtYWwgY3Jv c3Mtb3JpZ2luIGxvYWRzLCB0aGVyZWJ5IG5vdCBsZWFraW5nIFVSTCBpbmZvcm1hdGlvbiBkaXJl Y3RseSB0byBKUy4iKTsKIAotICAgICAgICB2YXIgbG9hZHMgPSAwOworICAgICAgICBmdW5jdGlv biBsb2FkSUZyYW1lV2l0aFNyYyhzcmNVUkwpCisgICAgICAgIHsKKyAgICAgICAgICAgIHZhciBp ZnJhbWUgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCJpZnJhbWUiKTsKKyAgICAgICAgICAgIGlm cmFtZS5vbmxvYWQgPSBsb2FkRXZlbnQoKTsKKyAgICAgICAgICAgIGlmcmFtZS5zcmMgPSBzcmNV Ukw7CisgICAgICAgICAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGlmcmFtZSk7CisgICAg ICAgIH0KIAorICAgICAgICB2YXIgbG9hZHMgPSAwOwogICAgICAgICBmdW5jdGlvbiBsb2FkRXZl bnQoKSB7CiAgICAgICAgICAgICBsb2FkcysrOwogICAgICAgICAgICAgdGVzdFBhc3NlZCgiSUZy YW1lICMiICsgbG9hZHMgKyAiIGdlbmVyYXRlZCBhICdsb2FkJyBldmVudC4iKTsKLSAgICAgICAg ICAgIGlmIChsb2FkcyA9PSAzKQorICAgICAgICAgICAgc3dpdGNoIChsb2FkcykKKyAgICAgICAg ICAgIHsKKyAgICAgICAgICAgIGNhc2UgMToKKyAgICAgICAgICAgICAgICBsb2FkSUZyYW1lV2l0 aFNyYygiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGlj eS9yZXNvdXJjZXMvYWxlcnQtcGFzcy5odG1sIik7CisgICAgICAgICAgICAgICAgYnJlYWs7Cisg ICAgICAgICAgICBjYXNlIDI6CisgICAgICAgICAgICAgICAgbG9hZElGcmFtZVdpdGhTcmMoImh0 dHBzOi8vbG9jYWxob3N0Ojg0NDMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3Jlc291 cmNlcy9hbGVydC1mYWlsLmh0bWwiKTsKKyAgICAgICAgICAgICAgICBicmVhazsKKyAgICAgICAg ICAgIGNhc2UgMzoKICAgICAgICAgICAgICAgICBzZXRUaW1lb3V0KGZpbmlzaEpTVGVzdCwgMCk7 CisgICAgICAgICAgICB9CiAgICAgICAgIH0KICAgICA8L3NjcmlwdD4KIDwvaGVhZD4KIDxib2R5 PgogICAgIDxpZnJhbWUgc3JjPSIvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3Jlc291 cmNlcy9hbGVydC1wYXNzLmh0bWwiIG9ubG9hZD0ibG9hZEV2ZW50KCkiPjwvaWZyYW1lPgotICAg IDxpZnJhbWUgc3JjPSJodHRwOi8vbG9jYWxob3N0OjgwODAvc2VjdXJpdHkvY29udGVudFNlY3Vy aXR5UG9saWN5L3Jlc291cmNlcy9hbGVydC1wYXNzLmh0bWwiIG9ubG9hZD0ibG9hZEV2ZW50KCki PjwvaWZyYW1lPgotICAgIDxpZnJhbWUgc3JjPSJodHRwczovL2xvY2FsaG9zdDo4NDQzL3NlY3Vy aXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXNvdXJjZXMvYWxlcnQtZmFpbC5odG1sIiBvbmxv YWQ9ImxvYWRFdmVudCgpIj48L2lmcmFtZT4KICAgICA8c2NyaXB0IHNyYz0iL2pzLXRlc3QtcmVz b3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+CiA8L2JvZHk+CiA8L2h0bWw+CmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9tYWMvVGVzdEV4cGVjdGF0aW9ucyBiL0xheW91 dFRlc3RzL3BsYXRmb3JtL21hYy9UZXN0RXhwZWN0YXRpb25zCmluZGV4IDdkNjA5ODFhNGQ5YTBk NDEzMTk5NDhlNjMyNDlkMzY1MWM2MTI0ODcuLmQ2ZDg0NzAyYjIzODQ0MTMyZjhiMTAyODQxMTEw Y2YzMTJmMzQ3N2YgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL3BsYXRmb3JtL21hYy9UZXN0RXhw ZWN0YXRpb25zCisrKyBiL0xheW91dFRlc3RzL3BsYXRmb3JtL21hYy9UZXN0RXhwZWN0YXRpb25z CkBAIC0xMDIzLDggKzEwMjMsNiBAQCB3ZWJraXQub3JnL2IvMTg3MTAzIGpzL2Vycm9yLXNob3Vs ZC1ub3Qtc3Ryb25nLXJlZmVyZW5jZS1nbG9iYWwtb2JqZWN0Lmh0bWwgWyBQYQogd2Via2l0Lm9y Zy9iLzE1NTUwNSBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS91c2Vy QWdlbnRTaGFkb3dET00vYWxsb3ctYXVkaW8uaHRtbCBbIFNraXAgXQogd2Via2l0Lm9yZy9iLzE1 NTUwNSBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS91c2VyQWdlbnRT aGFkb3dET00vYWxsb3ctdmlkZW8uaHRtbCBbIFNraXAgXQogCi13ZWJraXQub3JnL2IvMjMwNDI4 IGh0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L2ZyYW1lLXNyYy1jcm9z cy1vcmlnaW4tbG9hZC5odG1sIFsgUGFzcyBGYWlsdXJlIF0KLQogd2Via2l0Lm9yZy9iLzE1NDY4 OCBpbnNwZWN0b3IvY29udHJvbGxlci9ydW50aW1lLWNvbnRyb2xsZXIuaHRtbCBbIFBhc3MgVGlt ZW91dCBdCiAKIHdlYmtpdC5vcmcvYi8xNTYzNTEgc3RvcmFnZS9pbmRleGVkZGIvbW9kZXJuL2F1 dG9pbmNyZW1lbnQtYWJvcnQtcHJpdmF0ZS5odG1sIFsgUGFzcyBUaW1lb3V0IF0K