chrome-devtools-frontend 1.0.1705227 → 1.0.1708524

package/.agents/skills/code-review/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: code-review
+description: Generic checklist for reviewing DevTools CLs (your own before upload, or someone else's on Gerrit). Covers test correctness (tautological/vacuous tests, cleanup, leaks), code clarity, CL hygiene, and points to the specialized skills to consult for imports, UI, testing, strings, models, and verification. Use when asked to review a CL, a diff, a patch, or to self-review before `git cl upload`.
+---
+
+# Code Review
+
+This checklist comes from recurring reviewer feedback on landed DevTools CLs.
+Use it for self-review before upload and for reviewing other people's CLs.
+
+## 1. Gather context
+
+- **Local change:** `git diff origin/main...HEAD` (or `git show HEAD` for a
+  single-commit branch). To learn about the branch and upload workflow, see the
+  `devtools-version-control` skill.
+- **Gerrit CL:** strip the leading `)]}'` line from each response to get JSON:
+  - Diff: `git cl diff` (for the current branch), or fetch the patch set.
+  - Inline comments:
+    `curl -s https://chromium-review.googlesource.com/changes/devtools%2Fdevtools-frontend~<CL_NUMBER>/comments | tail -n +2`
+  - Messages:
+    `.../changes/devtools%2Fdevtools-frontend~<CL_NUMBER>/messages`
+- Read the CL description first. Then check that the diff does what the
+  description says, and nothing else.
+
+## 2. Consult the specialized skills
+
+Load the skill that matches what the diff touches, and apply its rules:
+
+| If the diff touches… | Use skill |
+| :--- | :--- |
+| Any `import` statement, or a new cross-module dependency | `devtools-imports` |
+| `UI.Widget`, lit-html views, components, CSS | `devtools-ui-widgets` |
+| Migration of legacy imperative DOM to widgets or Lit | `ui-eng-vision-orchestrator` (and its sub-skills) |
+| New or changed tests: choosing unit, API, or E2E | `devtools-testing-guidance` |
+| Tests that use `describeWithEnvironment` or `describeWithMockConnection`, or foundation modules | `foundation-test-migration` |
+| Ported Chromium web tests (`web_tests/http/tests/devtools`) | `migrate-chromium-test` |
+| Flaky or disabled tests, or `it.skip` / `it.skipOnPlatforms` | `fix-tests` |
+| `UIStrings` / user-facing text | `devtools-ux-writing-refactor` |
+| Rendering user-controlled strings (URLs, names, console text) | `devtools-unicode-escaping` |
+| `front_end/models/*`, `BUILD.gn`, `devtools_grd_files.gni`, entrypoints | `devtools-model-management` |
+| Merging modules or consolidating `BUILD.gn` | `merging-devtools-module` |
+| `Settings` registrations and descriptors | `devtools-setting-migration` |
+| Stack traces, source maps, `DebuggerWorkspaceBinding` | `devtools-source-maps` |
+| Building, running tests, or lint | `devtools-verification` |
+
+## 3. Test correctness (the most common review feedback)
+
+- **Tautological tests:** A test must exercise real production code. If a
+  mock does the thing the test asserts (for example, a mocked `DOM.undo` that
+  calls `removeSection()` directly, followed by an assertion that the section
+  was removed), the test checks the mock and nothing else. Mock the *boundary*
+  instead (for example, have the CDP stub emit `CSSModel.Events.StyleSheetChanged`)
+  and let production code react to it.
+- **Vacuous tests:** Look for local promises or data that are never connected
+  to DevTools logic, or stubs (like `initialize`) that skip the code path under
+  test. These tests pass because nothing happens.
+- **Assertions that check the setup:** For example,
+  `assert.isNull(pane.node())` right after `pane.setNodeForTest(null)`. Each
+  assertion should verify the behavior that the test name describes.
+- **Test lives where it belongs:** A test in `Foo.test.ts` should exercise
+  `Foo`. Move logic-only tests to the model's test file (for example,
+  `CSSMatchedStyles.test.ts`). Otherwise, render the UI and assert on the DOM.
+- **Test covers the scenario it claims:** For example, an "iframe event
+  listeners" test must select a node *inside* the iframe. It is not enough
+  that it passes on `<body>` of the main frame.
+- **Right suite:** Ask whether an E2E test could be a unit test, or whether the
+  E2E coverage is intentional for a user story. See `devtools-testing-guidance`.
+- **E2E selectors match real UI:** Labels and `aria-label`s must match the
+  actual strings, for example "Show user agent shadow DOM" and not "User agent
+  shadow DOM". Check that the setting being toggled actually affects the
+  scenario.
+- **Fail fast:** Throw or assert when a required value is missing. Don't let
+  the test time out later.
+
+## 4. Test hygiene and cleanup
+
+- Pair every `beforeEach` singleton creation with a cleanup in `afterEach`
+  (for example, `CSSWorkspaceBinding.removeInstance()` or
+  `WorkspaceImpl.removeInstance()`) so that state does not leak between tests.
+- Restore fake timers in `try { … } finally { clock.restore(); }`, or use the
+  sandbox or cleanup that the test runner provides. Keep the scope of fake
+  timers small.
+- Don't stub the same method twice without calling `restore()` first. Sinon
+  throws `Attempted to wrap … which is already wrapped` when the object is the
+  same instance.
+- Remove guards that were copied from helpers for no reason (for example,
+  `if (!stub.called) …` in a test that stubs the method only once).
+
+## 5. Code clarity
+
+- Don't take detours to reach a value. If a module is imported, call
+  `TextUtils.TextRange.TextRange.fromObject(...)` directly instead of going
+  through `rule.style.range.constructor`.
+- Look for dead code, leftover debug code, commented-out blocks, and unrelated
+  formatting churn.
+- Check that the change stays in scope. Flag unrelated refactors that should be
+  split into a separate CL.
+- Check for lifecycle issues: event listeners and observers that are added
+  without being removed, and async work that continues after a widget is
+  detached.
+
+## 6. CL hygiene
+
+- The description explains *why*, including external dependencies (for
+  example, "V8 will stop emitting X; this must land first").
+- Include a `Bug:` or `Fixed:` trailer, or `Bug: None`. Keep lines under 72
+  characters.
+- For migrations and stacked series, list the legacy tests or files covered,
+  and number the series (for example, `(13/16)`).
+- Disabled tests reference a bug.
+- Presubmit, lint, and format pass. See `devtools-verification`.
+
+## 7. Writing review comments
+
+- Be specific: cite file and line, explain the concrete failure mode (such as
+  a leak, a hang, or "passes vacuously"), and suggest a fix. Include a code
+  snippet when it helps.
+- Separate blocking issues from nits and questions (for example, "Should we
+  move this to a unit test?").
+- When a reviewer's concern is not an actual bug, reply with the rationale.
+  Don't make a silent change.

package/eslint.config.mjs

@@ -628,6 +628,7 @@ export default defineConfig([
       '@devtools/l10n-no-i18nString-calls-module-instantiation': 'error',
       '@devtools/l10n-no-uistrings-export': 'error',
       '@devtools/l10n-no-unused-message': 'error',
+      '@devtools/l10n-uistrings-sentence-punctuation': 'error',
       '@devtools/l10n-uistrings-text-style': 'error',
     },
   },

package/front_end/Images/src/nodejsHex.svg

@@ -0,0 +1,28 @@
+<svg width="200" height="200" viewBox="0 0 44 50" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <clipPath id="hexClip">
+      <path d="M22.8725 0.4166C22.136 0 21.2616 0 20.5253 0.4166L1.1505 11.6694C0.4142 12.0862 0 12.8733 0 13.707V36.2584C0 37.0921 0.4602 37.8791 1.1505 38.296L20.5253 49.5487C21.2616 49.9653 22.136 49.9653 22.8725 49.5487L42.2471 38.296C42.9836 37.8791 43.3976 37.0921 43.3976 36.2584V13.707C43.3976 12.8733 42.9375 12.0862 42.2471 11.6694L22.8725 0.4166Z" />
+    </clipPath>
+    <linearGradient id="main" x1="30.33" y1="8.56" x2="14.9" y2="44.7" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#3F8B3D"/>
+      <stop offset="0.64" stop-color="#3F873F"/>
+      <stop offset="0.93" stop-color="#3DA92E"/>
+      <stop offset="1" stop-color="#3DAE2B"/>
+    </linearGradient>
+    <linearGradient id="r1" x1="18.8" y1="26.8" x2="68" y2="0.4" gradientUnits="userSpaceOnUse">
+      <stop offset="0.14" stop-color="#3F873F"/>
+      <stop offset="0.4" stop-color="#52A044"/>
+      <stop offset="0.71" stop-color="#64B749"/>
+      <stop offset="0.91" stop-color="#6ABF4B"/>
+    </linearGradient>
+    <linearGradient id="r2" x1="0.25" y1="24.5" x2="44" y2="24.5" gradientUnits="userSpaceOnUse">
+      <stop offset="0.09" stop-color="#6ABF4B"/>
+      <stop offset="0.29" stop-color="#64B749"/>
+      <stop offset="0.6" stop-color="#52A044"/>
+      <stop offset="0.86" stop-color="#3F873F"/>
+    </linearGradient>
+  </defs>
+  <path fill="url(#main)" d="M22.8725 0.4166C22.136 0 21.2616 0 20.5253 0.4166L1.1505 11.6694C0.4142 12.0862 0 12.8733 0 13.707V36.2584C0 37.0921 0.4602 37.8791 1.1505 38.296L20.5253 49.5487C21.2616 49.9653 22.136 49.9653 22.8725 49.5487L42.2471 38.296C42.9836 37.8791 43.3976 37.0921 43.3976 36.2584V13.707C43.3976 12.8733 42.9375 12.0862 42.2471 11.6694L22.8725 0.4166Z" />
+  <polygon fill="url(#r1)" clip-path="url(#hexClip)" points="21.698901,-1.046618 43.20532,11.948247 21.698901,51.072715 0.152778,38.055107" />
+  <polygon fill="url(#r2)" clip-path="url(#hexClip)" points="21.698901,-1.046618 0.152778,11.948247 21.698901,51.072715 43.20532,38.055107" />
+</svg>

package/front_end/core/sdk/CPUThrottlingManager.ts

@@ -191,19 +191,22 @@ export class CPUThrottlingManager extends Common.ObjectWrapper.ObjectWrapper<Eve
     }
   }
 
-  #isCPUPerformanceOverrideActive(): boolean {
-    return this.#manualCPUPerformanceOverride !== undefined || this.#cpuThrottlingRate !== 1;
+  #activeCPUPerformanceOverride(): CPUPerformanceTier|undefined {
+    // If neither a manual override nor CPU throttling is enabled, no override is active.
+    if (this.#manualCPUPerformanceOverride === undefined && this.#cpuThrottlingRate === 1) {
+      return undefined;
+    }
+    return this.effectiveCPUPerformanceTier();
   }
 
   #syncCPUPerformanceTier(): void {
-    const effectiveTier = this.effectiveCPUPerformanceTier();
     // Synchronize with Chromium backend, via CDP.
-    const activeOverride = this.#isCPUPerformanceOverrideActive() ? effectiveTier : undefined;
+    const activeOverride = this.#activeCPUPerformanceOverride();
     for (const emulationModel of this.#targetManager.models(EmulationModel)) {
       void emulationModel.setCPUPerformanceOverride(activeOverride);
     }
     // Notify UI and other listeners.
-    this.dispatchEventToListeners(Events.CPU_PERFORMANCE_TIER_CHANGED, effectiveTier);
+    this.dispatchEventToListeners(Events.CPU_PERFORMANCE_TIER_CHANGED, this.effectiveCPUPerformanceTier());
   }
 
   setCPUThrottlingRate(rate: number): void {
@@ -282,9 +285,9 @@ export class CPUThrottlingManager extends Common.ObjectWrapper.ObjectWrapper<Eve
   }
 
   async updateHostDefaultCPUPerformanceTier(): Promise<void> {
-    if (this.#isCPUPerformanceOverrideActive()) {
-      // We do not want to update the host default tier when it is overridden
-      // (in which case, `navigator.cpuPerformance` would return the override).
+    if (this.#activeCPUPerformanceOverride() !== undefined) {
+      // We do not want to update the host default tier if an override has already been sent
+      // to the backend (in which case, `navigator.cpuPerformance` would return the override).
       return;
     }
     const target = this.#targetManager.primaryPageTarget();
@@ -314,8 +317,9 @@ export class CPUThrottlingManager extends Common.ObjectWrapper.ObjectWrapper<Eve
     if (this.#hardwareConcurrency !== undefined) {
       void emulationModel.setHardwareConcurrency(this.#hardwareConcurrency);
     }
-    if (this.#isCPUPerformanceOverrideActive()) {
-      void emulationModel.setCPUPerformanceOverride(this.effectiveCPUPerformanceTier());
+    const activeOverride = this.#activeCPUPerformanceOverride();
+    if (activeOverride !== undefined) {
+      void emulationModel.setCPUPerformanceOverride(activeOverride);
     }
 
     // If there are any callers blocked on a getHardwareConcurrency call, let's wake them now.

package/front_end/core/sdk/DOMModel.ts

@@ -319,7 +319,7 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
 
     const frameOwnerTags = new Set(['EMBED', 'IFRAME', 'OBJECT', 'FENCEDFRAME']);
     if (payload.contentDocument) {
-      this.contentDocumentInternal = new DOMDocument(this.#domModel, payload.contentDocument);
+      this.contentDocumentInternal = new DOMDocument(this.#domModel, payload.contentDocument, payload.frameId);
       this.contentDocumentInternal.parentNode = this;
       this.childrenInternal = [];
     } else if (payload.frameId && frameOwnerTags.has(payload.nodeName)) {
@@ -1139,7 +1139,7 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
   }
 
   isCustomElement(): boolean {
-    if (this.nodeType() !== NodeType.ELEMENT_NODE || this.isXMLNode()) {
+    if (this.nodeType() !== NodeType.ELEMENT_NODE || this.isXMLNode() || Boolean(this.pseudoType())) {
       return false;
     }
     const localName = this.localName() || this.nodeName().toLowerCase();
@@ -1391,17 +1391,27 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
   }
 
   async takeSnapshot(ownerDocumentSnapshot?: DOMDocument): Promise<DOMNode> {
-    const snapshot = (this instanceof DOMDocument) ? new DOMDocumentSnapshot(this.domModel(), {
-      nodeId: this.id,
-      backendNodeId: this.backendNodeId(),
-      nodeType: this.nodeType(),
-      nodeName: this.nodeName(),
-      localName: this.localName(),
-      nodeValue: this.nodeValueInternal,
-      documentURL: this.documentURL,
-      baseURL: this.baseURL,
-    } as Protocol.DOM.Node) :
-                                                     new DOMNodeSnapshot(this.domModel());
+    let snapshot: DOMNode;
+    if (this instanceof DOMDocument) {
+      const doc: DOMDocument = this;
+      snapshot = new DOMDocumentSnapshot(
+          this.domModel(),
+          {
+            nodeId: this.id,
+            backendNodeId: this.backendNodeId(),
+            nodeType: this.nodeType(),
+            nodeName: this.nodeName(),
+            localName: this.localName(),
+            nodeValue: this.nodeValueInternal,
+            documentURL: this.documentURL,
+            baseURL: this.baseURL,
+          } as Protocol.DOM.Node,
+          this.frameId(),
+          doc.securityOrigin(),
+      );
+    } else {
+      snapshot = new DOMNodeSnapshot(this.domModel());
+    }
     snapshot.id = this.id;
     snapshot.#backendNodeId = this.#backendNodeId;
     snapshot.#frameOwnerFrameId = this.#frameOwnerFrameId;
@@ -1573,16 +1583,35 @@ export class DOMDocument extends DOMNode {
   documentElement: DOMNode|null;
   #documentURL: Platform.DevToolsPath.UrlString;
   #baseURL: Platform.DevToolsPath.UrlString;
+  #frameId: Protocol.Page.FrameId|null;
   #securityOrigin: SecurityOrigin;
 
-  constructor(domModel: DOMModel, payload: Protocol.DOM.Node) {
+  constructor(
+      domModel: DOMModel,
+      payload: Protocol.DOM.Node,
+      frameId?: Protocol.Page.FrameId|null,
+  ) {
     super(domModel);
     this.body = null;
     this.documentElement = null;
     this.init(this, false, payload);
     this.#documentURL = (payload.documentURL || '') as Platform.DevToolsPath.UrlString;
     this.#baseURL = (payload.baseURL || '') as Platform.DevToolsPath.UrlString;
-    this.#securityOrigin = SecurityOrigin.create(this.#documentURL);
+    this.#frameId = frameId ?? null;
+
+    const resourceTreeModel = this.domModel().target().model(ResourceTreeModel);
+    const frame = this.#frameId ? resourceTreeModel?.frameForId(this.#frameId) : null;
+    if (frame) {
+      this.#securityOrigin = frame.securityOrigin();
+    } else if (resourceTreeModel?.mainFrame) {
+      // If the target has an active frame tree, a DOMDocument without a matching
+      // frame is a detached document and must be isolated with an opaque origin.
+      this.#securityOrigin = SecurityOrigin.createUniqueOpaque();
+    } else {
+      // TODO(b/567434846): Migrate synthetic unit tests to attach frames so this
+      // fallback to parsing documentURL can be removed.
+      this.#securityOrigin = SecurityOrigin.create(this.#documentURL);
+    }
   }
 
   get documentURL(): Platform.DevToolsPath.UrlString {
@@ -1593,10 +1622,14 @@ export class DOMDocument extends DOMNode {
     return this.#baseURL;
   }
 
+  override frameId(): Protocol.Page.FrameId|null {
+    return this.#frameId;
+  }
+
   /**
    * Returns the security origin of this document.
    *
-   * The security origin is derived from the document URL and is recomputed
+   * The security origin is resolved from the document's frame and is recomputed
    * when the document navigates to a new URL via `setDocumentURL`.
    */
   override securityOrigin(): SecurityOrigin {
@@ -1604,12 +1637,14 @@ export class DOMDocument extends DOMNode {
   }
 
   /**
-   * Updates the document and base URLs, and recomputes the document's security origin.
+   * Updates the document and base URLs, and updates the document's security origin.
    */
-  setDocumentURL(url: Platform.DevToolsPath.UrlString): void {
+  setDocumentURL(url: Platform.DevToolsPath.UrlString, securityOrigin?: SecurityOrigin|null): void {
     this.#documentURL = url;
     this.#baseURL = url;
-    this.#securityOrigin = SecurityOrigin.create(url);
+    // Prefer the canonical security origin from the frame, falling back to creating
+    // an origin from the URL as a last resort for test environments.
+    this.#securityOrigin = securityOrigin ?? SecurityOrigin.create(url);
   }
 }
 
@@ -1695,7 +1730,7 @@ export class DOMModel extends SDKModel<EventTypes> {
     if (node) {
       const contentDocument = node.contentDocument();
       if (contentDocument && contentDocument.documentURL !== frame.url) {
-        contentDocument.setDocumentURL(frame.url);
+        contentDocument.setDocumentURL(frame.url, frame.securityOrigin());
         this.dispatchEventToListeners(Events.DocumentURLChanged, contentDocument);
       }
     }
@@ -1879,7 +1914,8 @@ export class DOMModel extends SDKModel<EventTypes> {
     this.idToDOMNode = new Map();
     this.frameIdToOwnerNode = new Map();
     if (payload && 'nodeId' in payload) {
-      this.#document = new DOMDocument(this, payload);
+      const mainFrameId = this.target().model(ResourceTreeModel)?.mainFrame?.id;
+      this.#document = new DOMDocument(this, payload, mainFrameId);
     } else {
       this.#document = null;
     }
@@ -2543,6 +2579,22 @@ export class DOMNodeSnapshot extends DOMNode {
 }
 
 export class DOMDocumentSnapshot extends DOMDocument {
+  readonly #snapshotSecurityOrigin: SecurityOrigin;
+
+  constructor(
+      domModel: DOMModel,
+      payload: Protocol.DOM.Node,
+      frameId: Protocol.Page.FrameId|null|undefined,
+      securityOrigin: SecurityOrigin,
+  ) {
+    super(domModel, payload, frameId);
+    this.#snapshotSecurityOrigin = securityOrigin;
+  }
+
+  override securityOrigin(): SecurityOrigin {
+    return this.#snapshotSecurityOrigin;
+  }
+
   override init(
       _doc: DOMDocument|null, _isInShadowTree: boolean, _payload: Protocol.DOM.Node,
       _retainedNodes?: Set<Protocol.DOM.BackendNodeId>|undefined): void {

package/front_end/core/sdk/DebuggerModel.ts

@@ -1480,10 +1480,6 @@ export class Scope implements ScopeChainEntry {
     return undefined;
   }
 
-  empty(): boolean {
-    return Boolean(this.#payload.empty);
-  }
-
   extraProperties(): RemoteObjectProperty[] {
     if (this !== this.#callFrame.localScope() || this.#callFrame.script.isWasm()) {
       return [];

package/front_end/core/sdk/NetworkRequest.ts

@@ -179,6 +179,7 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
   #blockedReason: Protocol.Network.BlockedReason|undefined = undefined;
   #renderBlockingBehavior?: Protocol.Network.RenderBlockingBehavior;
   #initiatorSecurityOrigin?: SecurityOrigin;
+  #requestURLSecurityOrigin?: SecurityOrigin;
   #corsErrorStatus: Protocol.Network.CorsErrorStatus|undefined = undefined;
   statusCode = 0;
   statusText = '';
@@ -193,6 +194,7 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
   #resourceType: Common.ResourceType.ResourceType = Common.ResourceType.resourceTypes.Other;
   #contentData: Promise<TextUtils.ContentData.ContentDataOrError>|null = null;
   #streamingContentData: Promise<TextUtils.StreamingContentData.StreamingContentDataOrError>|null = null;
+  #resolvedStreamingContentData: TextUtils.StreamingContentData.StreamingContentData|null = null;
   readonly #frames: WebSocketFrame[] = [];
   #responseHeaderValues: Record<string, string|undefined> = {};
   #responseHeadersText = '';
@@ -402,10 +404,17 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
    * (`imported-har://${authority}`) to ensure recorded network traffic never collides with
    * live web origins.
    *
+   * The result is cached, so repeated calls return the same instance until the URL or the
+   * imported HAR flag changes. This keeps opaque origins (such as `data:` URLs) same-origin
+   * with themselves.
+   *
    * @see {@link initiatorSecurityOrigin} to obtain the origin of the document that initiated the request.
    */
   requestURLSecurityOrigin(): SecurityOrigin {
-    return this.#resolveSecurityOrigin(this.#url);
+    if (!this.#requestURLSecurityOrigin) {
+      this.#requestURLSecurityOrigin = this.#resolveSecurityOrigin(this.#url);
+    }
+    return this.#requestURLSecurityOrigin;
   }
 
   /**
@@ -422,6 +431,9 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
    * For imported HAR files, the origin is mapped to an isolated virtual domain
    * (`imported-har://${authority}`) matching the imported initiating document.
    *
+   * The result is cached, so repeated calls return the same instance until the imported HAR
+   * flag changes. This keeps opaque origins same-origin with themselves.
+   *
    * @see {@link requestURLSecurityOrigin} to obtain the origin of the target resource URL being requested.
    */
   initiatorSecurityOrigin(): SecurityOrigin {
@@ -462,6 +474,7 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
     this.#parsedQueryParameters = undefined;
     this.#name = undefined;
     this.#path = undefined;
+    this.#requestURLSecurityOrigin = undefined;
   }
 
   get documentURL(): Platform.DevToolsPath.UrlString {
@@ -1207,7 +1220,12 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
   }
 
   setIsImportedHar(isImportedHar: boolean): void {
+    if (this.#isImportedHar === isImportedHar) {
+      return;
+    }
     this.#isImportedHar = isImportedHar;
+    this.#requestURLSecurityOrigin = undefined;
+    this.#initiatorSecurityOrigin = undefined;
   }
 
   setEarlyHintsHeaders(headers: NameValue[]): void {
@@ -1488,9 +1506,11 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
       }
       // Note that this is save: "streamResponseBody()" always creates base64-based ContentData and
       // for "contentData()" we'll never call "addChunk".
-      return TextUtils.StreamingContentData.StreamingContentData.from(
+      const streamingContentData = TextUtils.StreamingContentData.StreamingContentData.from(
           contentData,
       );
+      this.#resolvedStreamingContentData = streamingContentData;
+      return streamingContentData;
     });
 
     return this.#streamingContentData;
@@ -1510,6 +1530,18 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
       isRegex: boolean,
       ): Promise<TextUtils.ContentProvider.SearchMatch[]> {
     if (!this.#contentDataProvider) {
+      const cachedContentData = this.finished && !this.failed ?
+          (await this.#contentData ?? this.#resolvedStreamingContentData?.content()) :
+          undefined;
+      if (cachedContentData && !TextUtils.ContentData.ContentData.isError(cachedContentData) &&
+          cachedContentData.isTextContent) {
+        return TextUtils.TextUtils.performSearchInContentData(
+            cachedContentData,
+            query,
+            caseSensitive,
+            isRegex,
+        );
+      }
       return await NetworkManager.searchInRequest(
           this,
           query,
@@ -1940,11 +1972,15 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
     }
     this.endTime = timestamp;
     if (data) {
-      void this.#streamingContentData?.then(contentData => {
-        if (!TextUtils.StreamingContentData.isError(contentData)) {
-          contentData.addChunk(data);
-        }
-      });
+      if (this.#resolvedStreamingContentData) {
+        this.#resolvedStreamingContentData.addChunk(data);
+      } else {
+        void this.#streamingContentData?.then(contentData => {
+          if (!TextUtils.StreamingContentData.isError(contentData)) {
+            contentData.addChunk(data);
+          }
+        });
+      }
     }
   }
 

package/front_end/core/sdk/PageResourceLoader.ts

@@ -343,24 +343,25 @@ export class PageResourceLoader extends Common.ObjectWrapper.ObjectWrapper<Event
       // directive is present. A null/error response keeps the guard armed so that a
       // detached-frame or protocol-error path cannot fall through to loadFromHostBindings.
       let mustEnforceCSP = isHttp;
-      if (isHttp && initiator.target) {
-        const networkManager = initiator.target.model(NetworkManager);
+      let frameTarget: Target|null = initiator.target;
+      while (frameTarget && !frameTarget.model(ResourceTreeModel)) {
+        frameTarget = frameTarget.parentTarget();
+      }
+      const frameId = initiator.frameId ?? frameTarget?.model(ResourceTreeModel)?.mainFrame?.id ?? null;
+      if (isHttp && frameTarget) {
+        const networkManager = frameTarget.model(NetworkManager);
         if (networkManager) {
-          let status = await networkManager.getSecurityIsolationStatus(initiator.frameId);
-          if (!status && initiator.frameId) {
-            status = await networkManager.getSecurityIsolationStatus(null);
-          }
-          if (status) {
-            const csps = status.csp ?? [];
-            mustEnforceCSP = csps.some(csp => csp.effectiveDirectives.includes('connect-src') ||
-                                           csp.effectiveDirectives.includes('default-src'));
+          const status = await networkManager.getSecurityIsolationStatus(frameId);
+          if (status?.csp) {
+            mustEnforceCSP = status.csp.some(csp => csp.effectiveDirectives.includes('connect-src') ||
+                                                 csp.effectiveDirectives.includes('default-src'));
           }
         }
       }
 
       try {
         Host.userMetrics.developerResourceLoaded(Host.UserMetrics.DeveloperResourceLoaded.LOAD_THROUGH_PAGE_VIA_TARGET);
-        const result = await this.loadFromTarget(initiator.target, initiator.frameId, url, isBinary);
+        const result = await this.loadFromTarget(frameTarget ?? initiator.target, frameId, url, isBinary);
         return result;
       } catch (e) {
         if (e instanceof Error) {

package/front_end/core/sdk/SourceMap.ts

@@ -12,7 +12,7 @@ import {scopeTreeForScript} from './ScopeTreeCache.js';
 import type {Script} from './Script.js';
 import {buildOriginalScopes, decodePastaRanges, type NamedFunctionRange} from './SourceMapFunctionRanges.js';
 import {decodeRangeMappings} from './SourceMapRangeMappings.js';
-import {scriptRelativePosition, SourceMapScopesInfo, type TranslatedFrame} from './SourceMapScopesInfo.js';
+import {type RawFrameTranslation, scriptRelativePosition, SourceMapScopesInfo} from './SourceMapScopesInfo.js';
 
 /**
  * Type of the base source map JSON object, which contains the sources and the mappings at the very least, plus
@@ -33,7 +33,8 @@ export interface SourceMapV3Object {
 
   names?: string[];
   ignoreList?: number[];
-  scopes?: string;
+  scopes?: Array<string|null>;
+  ranges?: string[];
   rangeMappings?: string;
   debugId?: string;
   x_google_linecount?: number;
@@ -609,11 +610,11 @@ export class SourceMap {
     if (!this.#scopesInfo) {
       this.#scopesInfo = new SourceMapScopesInfo(this, {scopes: [], ranges: []});
     }
-    if (map.scopes) {
+    if (map.scopes || map.ranges) {
       const {scopes, ranges} = ScopesCodec.decode(
           map as ScopesCodec.SourceMapJson,
           {mode: ScopesCodec.DecodeMode.LAX, generatedOffset: {line: baseLineNumber, column: baseColumnNumber}});
-      this.#scopesInfo.addOriginalScopes(scopes);
+      this.#scopesInfo.addOriginalScopes(scopes.length ? scopes : new Array(map.sources.length).fill(null));
       this.#scopesInfo.addGeneratedRanges(ranges);
     } else if (map.x_com_bloomberg_sourcesFunctionMappings) {
       const originalScopes = this.parseBloombergScopes(map);
@@ -662,7 +663,7 @@ export class SourceMap {
     }
   }
 
-  private parseBloombergScopes(map: SourceMapV3Object): Array<ScopesCodec.OriginalScope|null> {
+  private parseBloombergScopes(map: SourceMapV3Object): Array<ScopesCodec.OriginalScope[]|null> {
     const scopeList = map.x_com_bloomberg_sourcesFunctionMappings;
     if (!scopeList) {
       throw new Error('Cant decode pasta scopes without x_com_bloomberg_sourcesFunctionMappings field');
@@ -851,7 +852,8 @@ export class SourceMap {
     }
 
     const {line, column} = scriptRelativePosition(location);
-    return this.#scopesInfo.resolveMappedVariablesAtPosition(line, column, ignoreInnerBlockScopes);
+    return this.#scopesInfo.resolveMappedVariablesAtPosition(line, column, ignoreInnerBlockScopes,
+                                                             location.inlineFrameIndex);
   }
 
   findOriginalFunctionName(position: ScopesCodec.Position): string|null {
@@ -865,19 +867,10 @@ export class SourceMap {
     return this.#scopesInfo?.findOriginalFunctionScope(position) ?? null;
   }
 
-  isOutlinedFrame(generatedLine: number, generatedColumn: number): boolean {
+  /** See {@link SourceMapScopesInfo.translateRawFrame}. `null` if no scopes information is available. */
+  translateRawFrame(generatedLine: number, generatedColumn: number): RawFrameTranslation|null {
     this.#ensureSourceMapProcessed();
-    return this.#scopesInfo?.isOutlinedFrame(generatedLine, generatedColumn) ?? false;
-  }
-
-  hasInlinedFrames(generatedLine: number, generatedColumn: number): boolean {
-    this.#ensureSourceMapProcessed();
-    return this.#scopesInfo?.hasInlinedFrames(generatedLine, generatedColumn) ?? false;
-  }
-
-  translateCallSite(generatedLine: number, generatedColumn: number): TranslatedFrame[] {
-    this.#ensureSourceMapProcessed();
-    return this.#scopesInfo?.translateCallSite(generatedLine, generatedColumn) ?? [];
+    return this.#scopesInfo?.translateRawFrame(generatedLine, generatedColumn) ?? null;
   }
 }