[Site Isolation] Web Inspector deterministic Network IDs and event routing

Component: WebKit Web Inspector | 2bfe8ae

Under Site Isolation, each origin's content can run in its own WebContent process, but the Inspector frontend expects a single unified list of network resources and frames. To reconcile that, "octopus" agents (ProxyingNetworkAgent/ProxyingPageAgent) run in the UIProcess and aggregate events forwarded over IPC from each WebContent process, mapping process-local identifiers into a global, collision-free ID space by formatting type-prefixed strings such as "frame-PID.objectID" (IdentifierRegistry::protocolFrameId/protocolRequestId/protocolLoaderId). This commit introduces that ID scheme along with the ProcessQualified<ResourceLoaderIdentifier> serialization needed to pass process-scoped resource IDs between renderer and UIProcess, plus frontend JS that must now tolerate out-of-order events — a Network event arriving before the corresponding frame is known — and stub in frames for cross-origin iframes.

WebContent Process A            WebContent Process B            UIProcess
  ResourceLoaderIdentifier(3)     ResourceLoaderIdentifier(3)
         │                               │
         ▼                               ▼
  ProcessQualified<               ProcessQualified<
    ResourceLoaderIdentifier>       ResourceLoaderIdentifier>
  (PID_A, 3) ──IPC──────────────────────────────► ProxyingNetworkAgent
  (PID_B, 3) ──IPC──────────────────────────────► IdentifierRegistry::protocolRequestId()
                                                    "request-PID_A.3"
                                                    "request-PID_B.3"  (no collision)
                                                          │
                                                          ▼
                                              Inspector Frontend NetworkManager
                                              (single merged resource list)

Significance

This is new IPC and ID-derivation surface added specifically to bridge process boundaries that Site Isolation introduced. The inspector path is privileged but complex, and it now spans multiple sandboxed renderer processes rather than one.

Audit directions

Narrow: check whether the exposed frontend-facing string IDs leak process identifiers to inspector-facing surfaces, and whether malformed or adversarial FrameIdentifier/ResourceLoaderIdentifier values from a compromised renderer could produce colliding or spoofed IDs that confuse the UIProcess-side aggregation. The 1-arg protocolFrameId() overload recovers a process ID by bit-shifting FrameIdentifier's upper 32 bits, which the diff itself flags as incorrect for provisional frames (webkit.org/b/310164) — worth checking whether that known-incorrect fallback path is reachable with attacker-influenced identifiers. Wider: the new ProcessQualified<ResourceLoaderIdentifier> deserialization path in the UIProcess now trusts renderer-supplied identifiers to route inspector state across a trust boundary, so audit the other ProcessQualified<> deserializers reaching UIProcess-side registries for the same trust assumption. Match tell: a UIProcess-side map keyed on a value the renderer chooses, with no per-connection namespacing beyond a PID embedded in the key.

---