Bug 251595 – Affects teads.tv: about:blank nested twice inside other about:blank frames doesn’t load

• Component: Frames
• Status: RESOLVED FIXED

[Matthieu Wipliez]

This seems somewhat related to bug #251592

When creating nested iframes dynamically in JavaScript, only the first 2 iframes are correctly rendered.
It is necessary to use "document.write" to force the iframes to render properly on Safari (expect notably on Safari 16.3 as the aforementioned bug shows).

Steps to reproduce :
Go to the URL: https://sample.teads.net/demo/bugs/safari-nested-iframe.html
Scroll down to the red rectangle
Observe that you see "hey there 0" and "hey there 1".

Expected: "hey there 0", "hey there 1", "hey there 2", "hey there 3".
Open the page on Firefox or Chrome, and witness the expected behavior.

I'm marking this as "Major" rather than "Critical" only because there is a workaround thanks to document.write.

[Radar WebKit Bug Importer]

<rdar://problem/105102996>

[Karl Dubost]

Created attachment 464920 [details]
rendering of iframe 3

This is nested iframe 3 in blue.

[Matthieu Wipliez]

The nested iframe should appear within the others, no?

[Karl Dubost]

This might have been fixed by https://github.com/apple/WebKit/pull/380

[Karl Dubost]

Matthieu could you confirm?

[Matthieu Wipliez]

Hi Karl, sorry I have been out of office for a while. The bug is still present in Safari 17.1.2 as well as in Safari Technology Preview 17.4. The code works fine in both Chrome and Firefox latest versions.

[Karl Dubost]

Created attachment 469401 [details]
rendering in safari, firefox, chrome

iframe 2 and 3 are not visible the same way than they are visible in Firefox/Chrome.

Confirmed that this is still happening in 
STP Release 185 (Safari 17.4, WebKit 19618.1.9.8)
STP Release 186 (Safari 17.4, WebKit 19618.1.10.1.1)

[Karl Dubost]

<rdar://121021077>

[Suyash Kushwaha]

Hi Karl,

We have been experiencing this issue for a bit as well. The document.write workaround doesn't work for us either; perhaps we are doing something wrong.

[Suyash Kushwaha]

We just found out that adding srcset="" to the iframe is another workaround that can be used to get past this bug.

[Karl Dubost]

Created attachment 472275 [details]
testcase

I simplified the testcase so we could see better the iframes.
Remove CSS properties which were not necessary such as z-index, etc.

[Karl Dubost]

Created attachment 472276 [details]
rendering in safari, firefox, chrome for testcase

This was tested on 

Safari Technology Preview  201           20620.1.2
Firefox Nightly            131.0a1       13124.8.21
Google Chrome Canary       130.0.6672.0  6672.0

while the 4 iframes are inside the DOM, 

* we can only see 2 of them in Safari.
* we can see the 4 of them in Chrome and Firefox.

[Karl Dubost]

There seems to be a cutoff limit.

Increasing n, we can discover some limits.

Safari renders 2
Firefox renders 8
Chrome renders 100+

[Matthieu Wipliez]

Hi Karl,

do you have any news for this bug?

Thanks,
Matthieu

[Karl Dubost]

This is the assigned bug, so if there is more news coming about it, it will show up here. :)

[Justin Skinner]

I would argue that this should be considered ‘Critical’ rather than ‘Major’ because the workaround using document.write is not advisable due to security concerns, as it is susceptible to cross-site scripting (XSS) attacks.

[Matthieu Wipliez]

Hey there! I saw the release notes for Safari 18.4 today, and this bug is still present in Safari 18.4 Technology Preview 😭

[Karl Dubost]

rdar://148373033

[Karl Dubost]

Matthieu, you are right I opened a new radar for it.

[Karl Dubost]

Matthieu 
Do you know about a live website which is affected by this issue? That would be super helpful in addition to the nice testcase.

[Matthieu Wipliez]

Hi Karl,

unfortunately not a website, but it affects our business (ad rendering). For instance see: https://wigo.teads.tv/teads-tag-demo.html?vast=https://wigo.teads.tv/livedebug/upload/display-vast-1742908864025_saved.xml&format=display&celtra=true&teadsWigoDebug=enableFromAdSettings_1742908920740

This works on Chrome and Firefox, but not on Safari.

Hope this helps,
Matthieu

[Karl Dubost]

Thanks, that's useful information.

[Matthieu Wipliez]

Hi Karl,

do you have any news on this bug?
If nobody at Apple is willing to fix this, could you perhaps guide me so I can try to fix it?
I bet that other companies (especially in the ad tech sector) could benefit from this bug being fixed.

Thanks,
Matthieu

[Ryosuke Niwa]

Pull request: https://github.com/WebKit/WebKit/pull/56301

[Ryosuke Niwa]

<rdar://167813064>

[Ryosuke Niwa]

<rdar://148373033>

[Ryosuke Niwa]

Waiting on perf A/B testing results.

[EWS]

Committed 305404@main (d49e3f1c1997): <https://commits.webkit.org/305404@main>

Reviewed commits have been landed. Closing PR #56301 and removing active labels.