1 files changed, 34 insertions, 0 deletions
diff --git a/testing/web-platform/mozilla/tests/service-workers/bug1675097.https.html b/testing/web-platform/mozilla/tests/service-workers/bug1675097.https.html
new file mode 100644
index 0000000000..e093f616c1
--- /dev/null
+++ b/testing/web-platform/mozilla/tests/service-workers/bug1675097.https.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<title>Controlled iframe with initial about:blank becomes sandboxed</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// This test creates an iframe controlled by a service worker, which in turn has
+// another iframe in it. The inner iframe's fetch is intercepted by the service
+// worker, which notifies the outer iframe, which then adds the sandbox
+// attribute to the inner iframe. The outer iframe then signals the service
+// worker that it should evaluate self.clients.matchAll() and finally respond to
+// the inner iframe's fetch.
+// Evaluating self.clients.matchAll() causes the creation of the initial
+// about:blank document for the inner iframe, and if the sandboxing flags used
+// for that document are not the original flags for the inner iframe (i.e. none)
+// then the document will have an opaque origin, a case that we need to handle
+// properly.
+promise_test(async t => {
+    const URL = 'resources/bug1675097-sw.js';
+    const SCOPE = 'resources/';
+
+    const registration = await service_worker_unregister_and_register(t, URL, SCOPE);
+    t.add_cleanup(() => registration.unregister());
+
+    await wait_for_state(t, registration.installing, 'activated');
+
+    const outer = await with_iframe(SCOPE + 'bug1675097-iframe.html');
+    t.add_cleanup(() => outer.remove());
+}, 'Regression test for bug 1675097');
+
+</script>
+</body>