Loading the injected bundle may rely on being able to read from the paths in additionalReadAccessAllowedURLs, so the latter should be consumed first.
Created attachment 312243 [details] Change the order
Fixed in <https://trac.webkit.org/r217908>.