Bug 310676

Summary: [Site Isolation] Inconsistent console message ordering for tests which use Document::printNavigationErrorMessage compared to before Site Isolation
Product: WebKit Reporter: Anthony Tarbinian <a.tarbinian>
Component: New BugsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Anthony Tarbinian
Reported 2026-03-24 16:46:39 PDT
Tests which trigger Document::printNavigationErrorMessage will print out certain console log messages differently to their -expected.txt when run with Site Isolation enabled vs disabled. This is due to the fact that printNavigationErrorMessage calls frame.documentURLForConsoleLog. If frame is a LocalFrame, it will grab the document URL synchronously from document->url(). However, if frame is a RemoteFrame an asynchronous IPC call is sent to retrieve the URL. This difference in timing reveals itself in some tests which include the separate JS Exception which gets thrown in their -expected.txt file. With site isolation enabled, the message from printNavigationErrorMessage gets printed out at a later time than without site isolation. This allows the JS Exception to get printed before and cause a text diff -> test failure. See this -expected.txt for example: https://github.com/WebKit/WebKit/blob/875e3a58a1b2889a8cf92d13a650be5c652e0d0c/LayoutTests/http/tests/security/block-top-level-navigation-to-different-scheme-by-third-party-iframes-expected.txt#L3-L4 This is what it looks like pre Site Isolation ``` CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/block-top-level-navigation-to-different-scheme-by-third-party-iframes.html' from frame with URL 'http://localhost:8000/security/resources/navigate-top-level-frame-to-failure-page-different-scheme.html'. The frame attempting navigation of the top-level window is cross-origin or untrusted and the user has never interacted with the frame. CONSOLE MESSAGE: SecurityError: The operation is insecure. CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/block-top-level-navigation-to-different-scheme-by-third-party-iframes.html' from frame with URL 'http://localhost:8000/security/resources/navigate-top-level-frame-to-failure-page-different-scheme.html'. The frame attempting navigation of the top-level window is cross-origin or untrusted and the user has never interacted with the frame. CONSOLE MESSAGE: SecurityError: The operation is insecure. ``` This is what is printed with Site Isolation ``` CONSOLE MESSAGE: SecurityError: The operation is insecure. CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/block-top-level-navigation-to-different-scheme-by-third-party-iframes.html' from frame with URL 'http://localhost:8000/security/resources/navigate-top-level-frame-to-failure-page-different-scheme.html'. The frame attempting navigation of the top-level window is cross-origin or untrusted and the user has never interacted with the frame. CONSOLE MESSAGE: SecurityError: The operation is insecure. CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/block-top-level-navigation-to-different-scheme-by-third-party-iframes.html' from frame with URL 'http://localhost:8000/security/resources/navigate-top-level-frame-to-failure-page-different-scheme.html'. The frame attempting navigation of the top-level window is cross-origin or untrusted and the user has never interacted with the frame. ```
Attachments
Radar WebKit Bug Importer
Comment 1 2026-03-24 16:46:47 PDT
Anthony Tarbinian
Comment 2 2026-03-24 16:58:48 PDT
EWS
Comment 3 2026-03-25 16:15:56 PDT
Committed 309948@main (33b1b5a695b2): <https://commits.webkit.org/309948@main> Reviewed commits have been landed. Closing PR #61287 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.