Repository navigation
fix(window): enforce parent-origin and native receiver access checks - #1651
Merged
Merged
Conversation
Compare contentDocument and frameElement with the frame owner Document, including navigation and document.domain changes. Publish child Documents through the native private slot instead of redefining Window.document.
Add declarative V8 receiver access checks and Window brand validation. Authorize SameObject getters before cache reads, preserve captured objects for retired Realms, and materialize child proxies for the actual accessing context with isolated facade tokens.
Resolve the current owner Document and viewport when reading held child computed styles. Exercise adoption, pseudo-elements, argument conversion, and declaration identity with real iframe Realms.
Keep windowless and disconnected iframe elements without a contentWindow or contentDocument. Delete synchronous document loading and synthetic Window eval, style, and messaging code; migrate MIME and lifecycle coverage to protected live frames or standard null behavior.
Sequential Navigation Soak A/BWorkflow: No navigation resilience or memory conclusion is available for this run. |
Spider Bench A/BWorkflow: No benchmark result or performance conclusion is available for this run. |
CI Regression ReportSource CI run · source state at render:
Release regression — ✅ HEAD/base failures 0/0; raw binary +0.001356%Package and image size
Startup latency and PSS
Concurrency matrix
Frontend differential — ✅ 1,020/1,020 cases matched; 0 issues
Agent episodes · Moli vs Chromium — ⚪ artifact unavailable or invalidArtifact unavailable or invalid. See the source CI run for infrastructure details. Runtime and CDP session contracts — ✅ 26 contract cases; 0 failures
CDP smoke — ✅ 52/52 groups passed; 621 scenariosWorkers: 4 · cumulative group time: 132.98 s · failed groups: 0
WebMainBench · 545 pages — ✅ 545/545 completed; 0 unexpected failures
Frozen HTML · Linux · Diagnostics: All artifact fields are parsed by the trusted default-branch renderer; missing or invalid inputs remain visible as unavailable. |
ldm0
added a commit
that referenced
this pull request
Oct 18, 2026
A retained child's original SameObject getter captured undefined when its lazy surface had never been read. Returning that snapshot after retirement made Window.screen disappear when an iframe was removed before its first read. Use captured objects when present, and let the exact retained native global materialize an untouched surface in its original Realm. Retain receiver and cross-origin authorization. Cover cold Screen reads, identity and zero geometry. Fixes: 9f11881 (PR #1651) Validation of the complete fix set, with unchanged source content across the separate logical commits: - cargo fmt --all - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo nextest run --no-fail-fast: 20374 passed, 18 skipped
ldm0
added a commit
that referenced
this pull request
Oct 19, 2026
A retained child's original SameObject getter captured undefined when its lazy surface had never been read. Returning that snapshot after retirement made Window.screen disappear when an iframe was removed before its first read. Use captured objects when present, and let the exact retained native global materialize an untouched surface in its original Realm. Retain receiver and cross-origin authorization. Cover cold Screen reads, identity and zero geometry. Fixes: 9f11881 (PR #1651) Validation of the complete fix set, with unchanged source content across the separate logical commits: - cargo fmt --all - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo nextest run --no-fail-fast: 20374 passed, 18 skipped Original-commit: d61a6c8
ldm0
added a commit
that referenced
this pull request
Oct 21, 2026
A retained child's original SameObject getter captured undefined when its lazy surface had never been read. Returning that snapshot after retirement made Window.screen disappear when an iframe was removed before its first read. Use captured objects when present, and let the exact retained native global materialize an untouched surface in its original Realm. Retain receiver and cross-origin authorization. Cover cold Screen reads, identity and zero geometry. Fixes: 9f11881 (PR #1651) Validation of the complete fix set, with unchanged source content across the separate logical commits: - cargo fmt --all - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo nextest run --no-fail-fast: 20374 passed, 18 skipped Original-commit: d61a6c8
ldm0
added a commit
that referenced
this pull request
Oct 22, 2026
A retained child's original SameObject getter captured undefined when its lazy surface had never been read. Returning that snapshot after retirement made Window.screen disappear when an iframe was removed before its first read. Use captured objects when present, and let the exact retained native global materialize an untouched surface in its original Realm. Retain receiver and cross-origin authorization. Cover cold Screen reads, identity and zero geometry. Fixes: 9f11881 (PR #1651) Validation of the complete fix set, with unchanged source content across the separate logical commits: - cargo fmt --all - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo nextest run --no-fail-fast: 20374 passed, 18 skipped Original-commit: d61a6c8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nested cross-origin frames currently authorize
contentDocumentagainst the top Window, so A → B → A can expose A’s Document to B while A → B → B incorrectly returns null.frameElementand borrowed native Window callbacks also expose foreign objects, and inert DOMParser iframes can create an unprotected synthetic Window that synchronously loads itssrc.This follow-up to #1594 fixes those paths in four commits:
contentDocumentand cachedframeElementagainst the iframe’s actual node Document, including navigation anddocument.domainchanges.Validation from the repository root with
CARGO_BUILD_JOBS=24:cargo fmt --allcargo clippy --workspace --all-targets --all-features -- -D warningscargo nextest run --no-fail-fast: 20,249 passed, 18 skippedcargo build -p moliframeElement, borrowed native calls, forged receivers, inert iframe null behavior, and held computed styles after adoption.Borrowed getter reflection for Window aliases,
onmessage, andlocationstill has compatibility differences from Chromium. The same differences occur in the baseline probe; they are outside this change.Remaining work from the broader audit includes consolidating cross-origin property policy, reviewing the standalone lightweight popup fallback, and expanding the WPT matrix. This PR does not claim that every special Window construction path has been unified.