[Site Isolation] Cross-process resource and loaderId aggregation in Page.getResourceTree

df1a3bd

Under Site Isolation each cross-origin frame runs in its own WebContent process, but CachedResourceLoader (holding cached subresources) lives in the hosting process, not the UIProcess. The Web Inspector's Page.getResourceTree previously returned correct frame structure and URLs for cross-origin frames but left loaderId and resources empty, having no cross-process retrieval path.

LayoutTests/http/tests/site-isolation/inspector/page/resource-tree-resources-cross-origin-iframe.html

for (let attempt = 0; attempt < 50; ++attempt) {
    ({ frameTree } = await WI.backendTarget.PageAgent.getResourceTree());
    child = frameTree.childFrames?.[0];
    if (child && (child.resources || []).some((r) => r.url.endsWith("/resource-tree-subframe-style.css")))
        break;
    await new Promise((resolve) => setTimeout(resolve, 50));
}

The proxy now walks the WebFrameProxy tree, groups frame IDs by hosting process, sends each process a typed GetFrameResourceData IPC request carrying only that process's frame IDs, and assembles the replied structs into a unified tree via a CallbackAggregator. The command is made asynchronous to accommodate the round-trips; secure decoding is auto-generated from a new serialization.in file.

Significance

This adds a new async multi-process IPC path in the Web Inspector — a CallbackAggregator spanning multiple WebContent processes — exactly the kind of code where frame-lifetime bugs and TOCTOU races appear.

Audit directions

The frame-to-process grouping walk occurs without a stable snapshot of the frame tree — if a cross-origin frame navigates or detaches after the walk but before the IPC reply lands, the aggregator may receive data keyed to a stale frame ID; trace whether that mismatch is ignored, inserted at the wrong position, or a UAF. WebInspectorBackend::getFrameResourceData in the WebContent process iterates the frame IDs the UIProcess sent — if a navigation race makes a frame ID belong to a different process, the WebContent process must not serve data for a foreign frame, and that validation boundary is new. The loaderId caching path (cached on frameNavigated, with a fallback to the hosting process's reported identifier) creates two code paths that must derive identical protocol IDs; a divergence could let an inspector client cross-correlate resources across origins via mismatched loaderIds.