Bug 321255

Under site isolation, a frame in the fullscreen chain can unload without the embedding document's fullscreen state being cleared. The embedder is left with a viewport-sized iframe as document.fullscreenElement, taking every hit test and with no exit fullscreenchange, so the page underneath cannot be reached while its scripts keep running. An attacker-controlled frame that nests another frame can reach it. Entering fullscreen flags every ancestor frame's owner element, and under site isolation those ancestors live in other web processes, flagged there over IPC. There is no exit-side counterpart to that enter-side IPC, and two paths leave it uncleared: 1. A cross-site self-navigation by the fullscreen subframe resolves to LoadWillContinueInAnotherProcess, so in the process owning the outgoing document the frame loader returns before dispatchDidStartProvisionalLoad and no exit request is made. 2. When a frame in the chain that does not own the fullscreen element navigates, that process never had m_element set, so willExitFullScreen early-returns, BeganExitFullScreen is never sent, and exitFullScreenInOtherProcesses never runs. Not reachable in a shipping configuration: SiteIsolationEnabled is status: unstable, default false. NOT REPRODUCED. The above is from reading the source. No site-isolated repro was built and no test was run against it. Existing coverage under LayoutTests/http/tests/site-isolation/ never navigates a frame in the fullscreen chain.