[Site Isolation] Web Inspector: add ProxyingPageAgent and PageAgentProxy stubs for cross-process Page domain

6fd4b1f

Web Inspector uses a domain-agent model: each protocol domain has a corresponding agent instrumenting its subsystem. Under Site Isolation, cross-origin iframes run in separate WebContent processes, so a single InspectorPageAgent only sees frames it hosts locally. The "octopus pattern" places a lightweight proxy agent in each WebContent process that forwards instrumentation events via IPC to an aggregating ProxyingAgent in the UIProcess, which dispatches protocol events to the frontend. This commit ports the pattern from Network to Page domain.

Source/WebCore/inspector/InstrumentingAgents.h

+#define DEFINE_INSPECTOR_AGENT_PageProxy(macro, Getter, Setter) \

+ DEFINE_INSPECTOR_AGENT(macro, Inspector::PageAgentInstrumentation, PageProxy, Getter, Setter)

Four IPC messages flow renderer → UIProcess (FrameNavigated, DomContentEventFired, LoadEventFired, FrameDetached). m_pinnedInstrumentedProcesses pins a Ref<WebProcessProxy> while instrumentation is active so the IPC receiver can always be removed. Page backend commands (getResourceTree, reload, getCookies) are stubbed with error responses pending follow-up bugs.

Significance

Creates new IPC attack surface from potentially compromised renderer processes into the inspector's UIProcess-side agent — four messages handled in the privileged UIProcess with attacker-controlled parameters.

Audit directions

All four IPC handlers in ProxyingPageAgent.cpp — especially frameNavigated, which constructs protocol objects with frame/loader IDs; the commit acknowledges loaderId uses a placeholder, meaning the forwarding path hasn't been reviewed. The m_pinnedInstrumentedProcesses lifetime: does enableInstrumentationForProcess guard against double-registration, can disableInstrumentationForProcess be driven to remove a never-added receiver? The five WebPageInspectorController lifecycle hooks — particularly didCommitProvisionalFrame and didCommitProvisionalPage performing disable(old)/enable(new) transitions — could race a navigation commit against a frontend disconnect, leaving a dangling receiver or calling removeMessageReceiver twice. EnablePageInstrumentation/DisablePageInstrumentation flow UIProcess→WebContent and control whether PageAgentProxy attaches; incorrect ordering relative to process teardown could leave stale instrumentation hooks.