[Site Isolation] Coalesce frame geometry updates into a single page-level message

Component: WebKit Site Isolation | f4bfa28

LayoutTests/http/tests/site-isolation/do-not-rebroadcast-unchanged-frame-geometry.html

+const countSentGeometryFor = action => countSentFor(() => internals.sentFrameGeometryCount(), action);
+const countSentViewportInfoFor = action => countSentFor(() => internals.sentFrameViewportInfoCount(), action);
...
+    assert_equals(await countSentGeometryFor(() => window.scrollTo(0, 350)), 1,
+        "a scroll that moves the edge of the viewport across the cross-site frame must send the frame geometry");
...
+    assert_equals(await countSentViewportInfoFor(() => {
+        window.scrollTo(0, 1200);
+        window.scrollTo(0, 1300);
+        window.scrollTo(0, 1400);
+    }), 1, "several scrolls in one task must send the viewport info once");

With site isolation, each WebContent process holds RemoteFrame stand-ins for frames it doesn't host and needs their position, size and visible rect for layout, IntersectionObserver and throttling. Each process owns its local frames' geometry and reports it to UIProcess — the trusted broker mapping frame IDs to WebFrameProxy objects — which relays it to the page's other processes.

The per-frame broadcastFrameTreeSyncData geometry IPC becomes one page-level WebPageProxy::HandleFrameGeometryUpdates message sent at rendering-update time by WebPage::broadcastFrameGeometryUpdatesIfNeeded. UIProcess stores the geometry on each WebFrameProxy and forwards it; receivers apply the batch in WebPage::frameGeometryChangedInAnotherProcess. Relay filtering (skip main-frame scroll updates for processes with no frames in the viewport, skip frames with no remote descendants) moves from the sender into UIProcess.

Significance

The change cuts IPC volume and gives UIProcess current geometry for every frame, which later optimizations need. UIProcess, not the sending WebProcess, becomes the policy point that decides which processes see which frame geometry.

Audit directions

Batch handler validation and authority. Check how handleFrameGeometryUpdates resolves frame IDs — unknown, stale, detached, duplicated, or belonging to another process's frames — and whether a compromised WebContent can overwrite geometry for frames other sites own and feed them spoofed rects or viewport info.
Receiver-side batch application. frameGeometryChangedInAnotherProcess applies a whole vector before updating remote IntersectionObservers and the PDF HUD once; check frames removed or navigated mid-batch and frame lifetime across the loop.
Unordered standalone messages. Geometry deliberately travels outside RemoteLayerTreeCommitBundle (a commit can block on backing-store flush), so it can arrive before or after RemotePageProxy injection, setDrawingArea or frame-tree changes; cached lastSentMainFrameViewportInfo may go stale.
Untrusted numerics and filtering. NaN, huge or negative sizes and LayoutRect overflow flow into layout and IntersectionObserver math in other processes; moved suppression logic could leak cross-origin frame positions or skip needed updates.