From 23caed9eac4832ddff3674175dc8fbf944381ead Mon Sep 17 00:00:00 2001
From: Stanca Serban <sstanca@mozilla.com>
Date: Fri, 29 Mar 2024 20:52:30 +0200
Subject: [PATCH] Backed out 6 changesets (bug 1876574, bug 1876575) for
 causing multiple failures. CLOSED TREE

Backed out changeset 8c7a9f405031 (bug 1876575)
Backed out changeset 49739f9ec590 (bug 1876575)
Backed out changeset 1c49f0c3b677 (bug 1876575)
Backed out changeset 1ca7a0f27bc0 (bug 1876575)
Backed out changeset bfa9862e3480 (bug 1876575)
Backed out changeset 58576ed7eb22 (bug 1876574)
---
 caps/OriginAttributes.cpp                          |  93 +++++----------
 caps/OriginAttributes.h                            |  29 ++---
 dom/base/ChromeUtils.cpp                           |  10 +-
 dom/base/Document.cpp                              |  12 --
 dom/base/ThirdPartyUtil.cpp                        |  14 +--
 dom/chrome-webidl/ChromeUtils.webidl               |   1 -
 dom/indexedDB/test/test_third_party.html           |   8 +-
 dom/serviceworkers/ServiceWorkerPrivate.cpp        |   6 +-
 dom/serviceworkers/ServiceWorkerScriptCache.cpp    |   3 +-
 dom/workers/ScriptLoader.cpp                       |   4 +-
 dom/workers/WorkerLoadInfo.cpp                     |   2 +-
 dom/workers/WorkerLoadInfo.h                       |   2 +-
 dom/workers/WorkerPrivate.cpp                      |   7 +-
 dom/workers/WorkerPrivate.h                        |   4 +-
 dom/workers/remoteworkers/RemoteWorkerChild.cpp    |   2 +-
 dom/workers/remoteworkers/RemoteWorkerTypes.ipdlh  |   2 +-
 netwerk/cookie/CookieJarSettings.cpp               |  20 +---
 netwerk/cookie/CookieJarSettings.h                 |   4 +-
 netwerk/protocol/http/HttpBaseChannel.cpp          |   1 +
 .../test_different_domain_in_hierarchy.html        |   2 +-
 .../samesite/sandbox-iframe-nested.https.html.ini  |   4 -
 .../sandbox-iframe-subresource.https.html.ini      |   5 -
 .../partitioned.tentative.https.html.ini           |   3 +-
 ...ageAccess-ABA.tentative.sub.https.window.js.ini |   4 +
 ...ss-site-sibling-iframes.sub.https.window.js.ini |   4 +
 .../partitioned-web-locks.tentative.https.html.ini |  10 +-
 .../components/antitracking/AntiTrackingUtils.cpp  | 131 ++++++---------------
 .../antitracking/StorageAccessAPIHelper.cpp        |   7 +-
 .../antitracking/StoragePrincipalHelper.cpp        |  41 ++-----
 .../antitracking/StoragePrincipalHelper.h          |   8 --
 .../antitracking/test/browser/browser.toml         |   2 -
 .../test/browser/browser_doublyNestedTracker.js    |   2 +-
 .../test/browser/browser_partitionedABA.js         |  86 --------------
 ...torageAccessThirdPartyChecks_alwaysPartition.js |   1 -
 .../resistfingerprinting/nsRFPService.cpp          |  64 ++--------
 35 files changed, 155 insertions(+), 443 deletions(-)
 create mode 100644 testing/web-platform/meta/storage-access-api/requestStorageAccess-cross-site-sibling-iframes.sub.https.window.js.ini
 delete mode 100644 toolkit/components/antitracking/test/browser/browser_partitionedABA.js

diff --git a/caps/OriginAttributes.cpp b/caps/OriginAttributes.cpp
index 0b7b00f91425..211d6b00e7f5 100644
--- a/caps/OriginAttributes.cpp
+++ b/caps/OriginAttributes.cpp
@@ -22,8 +22,8 @@ static const char kSanitizedChar = '+';
 namespace mozilla {
 
 static void MakeTopLevelInfo(const nsACString& aScheme, const nsACString& aHost,
-                             int32_t aPort, bool aForeignByAncestorContext,
-                             bool aUseSite, nsAString& aTopLevelInfo) {
+                             int32_t aPort, bool aUseSite,
+                             nsAString& aTopLevelInfo) {
   if (!aUseSite) {
     aTopLevelInfo.Assign(NS_ConvertUTF8toUTF16(aHost));
     return;
@@ -41,26 +41,19 @@ static void MakeTopLevelInfo(const nsACString& aScheme, const nsACString& aHost,
     site.Append(",");
     site.AppendInt(aPort);
   }
-  if (aForeignByAncestorContext) {
-    site.Append(",f");
-  }
   site.AppendLiteral(")");
 
   aTopLevelInfo.Assign(NS_ConvertUTF8toUTF16(site));
 }
 
 static void MakeTopLevelInfo(const nsACString& aScheme, const nsACString& aHost,
-                             bool aForeignByAncestorContext, bool aUseSite,
-                             nsAString& aTopLevelInfo) {
-  MakeTopLevelInfo(aScheme, aHost, -1, aForeignByAncestorContext, aUseSite,
-                   aTopLevelInfo);
+                             bool aUseSite, nsAString& aTopLevelInfo) {
+  MakeTopLevelInfo(aScheme, aHost, -1, aUseSite, aTopLevelInfo);
 }
 
 static void PopulateTopLevelInfoFromURI(const bool aIsTopLevelDocument,
-                                        nsIURI* aURI,
-                                        bool aForeignByAncestorContext,
-                                        bool aIsFirstPartyEnabled, bool aForced,
-                                        bool aUseSite,
+                                        nsIURI* aURI, bool aIsFirstPartyEnabled,
+                                        bool aForced, bool aUseSite,
                                         nsString OriginAttributes::*aTarget,
                                         OriginAttributes& aOriginAttributes) {
   nsresult rv;
@@ -93,7 +86,7 @@ static void PopulateTopLevelInfoFromURI(const bool aIsTopLevelDocument,
 
   if (scheme.EqualsLiteral("about")) {
     MakeTopLevelInfo(scheme, nsLiteralCString(ABOUT_URI_FIRST_PARTY_DOMAIN),
-                     aForeignByAncestorContext, aUseSite, topLevelInfo);
+                     aUseSite, topLevelInfo);
     return;
   }
 
@@ -135,8 +128,7 @@ static void PopulateTopLevelInfoFromURI(const bool aIsTopLevelDocument,
   nsAutoCString baseDomain;
   rv = tldService->GetBaseDomain(uri, 0, baseDomain);
   if (NS_SUCCEEDED(rv)) {
-    MakeTopLevelInfo(scheme, baseDomain, aForeignByAncestorContext, aUseSite,
-                     topLevelInfo);
+    MakeTopLevelInfo(scheme, baseDomain, aUseSite, topLevelInfo);
     return;
   }
 
@@ -168,14 +160,12 @@ static void PopulateTopLevelInfoFromURI(const bool aIsTopLevelDocument,
       ipAddr = host;
     }
 
-    MakeTopLevelInfo(scheme, ipAddr, port, aForeignByAncestorContext, aUseSite,
-                     topLevelInfo);
+    MakeTopLevelInfo(scheme, ipAddr, port, aUseSite, topLevelInfo);
     return;
   }
 
   if (aUseSite) {
-    MakeTopLevelInfo(scheme, host, port, aForeignByAncestorContext, aUseSite,
-                     topLevelInfo);
+    MakeTopLevelInfo(scheme, host, port, aUseSite, topLevelInfo);
     return;
   }
 
@@ -183,8 +173,7 @@ static void PopulateTopLevelInfoFromURI(const bool aIsTopLevelDocument,
     nsAutoCString publicSuffix;
     rv = tldService->GetPublicSuffix(uri, publicSuffix);
     if (NS_SUCCEEDED(rv)) {
-      MakeTopLevelInfo(scheme, publicSuffix, port, aForeignByAncestorContext,
-                       aUseSite, topLevelInfo);
+      MakeTopLevelInfo(scheme, publicSuffix, port, aUseSite, topLevelInfo);
       return;
     }
   }
@@ -193,7 +182,7 @@ static void PopulateTopLevelInfoFromURI(const bool aIsTopLevelDocument,
 void OriginAttributes::SetFirstPartyDomain(const bool aIsTopLevelDocument,
                                            nsIURI* aURI, bool aForced) {
   PopulateTopLevelInfoFromURI(
-      aIsTopLevelDocument, aURI, false, IsFirstPartyEnabled(), aForced,
+      aIsTopLevelDocument, aURI, IsFirstPartyEnabled(), aForced,
       StaticPrefs::privacy_firstparty_isolate_use_site(),
       &OriginAttributes::mFirstPartyDomain, *this);
 }
@@ -214,21 +203,19 @@ void OriginAttributes::SetFirstPartyDomain(const bool aIsTopLevelDocument,
   mFirstPartyDomain = aDomain;
 }
 
-void OriginAttributes::SetPartitionKey(nsIURI* aURI,
-                                       bool aForeignByAncestorContext) {
+void OriginAttributes::SetPartitionKey(nsIURI* aURI) {
   PopulateTopLevelInfoFromURI(
-      false /* aIsTopLevelDocument */, aURI, aForeignByAncestorContext,
-      IsFirstPartyEnabled(), true /* aForced */,
-      StaticPrefs::privacy_dynamic_firstparty_use_site(),
+      false /* aIsTopLevelDocument */, aURI, IsFirstPartyEnabled(),
+      true /* aForced */, StaticPrefs::privacy_dynamic_firstparty_use_site(),
       &OriginAttributes::mPartitionKey, *this);
 }
 
-void OriginAttributes::SetPartitionKey(const nsACString& aOther) {
-  SetPartitionKey(NS_ConvertUTF8toUTF16(aOther));
+void OriginAttributes::SetPartitionKey(const nsACString& aDomain) {
+  SetPartitionKey(NS_ConvertUTF8toUTF16(aDomain));
 }
 
-void OriginAttributes::SetPartitionKey(const nsAString& aOther) {
-  mPartitionKey = aOther;
+void OriginAttributes::SetPartitionKey(const nsAString& aDomain) {
+  mPartitionKey = aDomain;
 }
 
 void OriginAttributes::CreateSuffix(nsACString& aStr) const {
@@ -432,20 +419,17 @@ bool OriginAttributes::IsPrivateBrowsing(const nsACString& aOrigin) {
 bool OriginAttributes::ParsePartitionKey(const nsAString& aPartitionKey,
                                          nsAString& outScheme,
                                          nsAString& outBaseDomain,
-                                         int32_t& outPort,
-                                         bool& outForeignByAncestorContext) {
+                                         int32_t& outPort) {
   outScheme.Truncate();
   outBaseDomain.Truncate();
   outPort = -1;
-  outForeignByAncestorContext = false;
 
-  // Partition keys have the format
-  // "(<scheme>,<baseDomain>[,port][,foreignancestorbit])". The port and
-  // ancestor bits are optional. For example: "(https,example.com,8443)" or
-  // "(http,example.org)", or "(http,example.info,f)", or
-  // "(http,example.biz,8443,f)". When privacy.dynamic_firstparty.use_site =
-  // false, the partitionKey contains only the host, e.g. "example.com". See
-  // MakeTopLevelInfo for the partitionKey serialization code.
+  // Partition keys have the format "(<scheme>,<baseDomain>,[port])". The port
+  // is optional. For example: "(https,example.com,8443)" or
+  // "(http,example.org)".
+  // When privacy.dynamic_firstparty.use_site = false, the partitionKey contains
+  // only the host, e.g. "example.com".
+  // See MakeTopLevelInfo for the partitionKey serialization code.
 
   if (aPartitionKey.IsEmpty()) {
     return true;
@@ -482,27 +466,14 @@ bool OriginAttributes::ParsePartitionKey(const nsAString& aPartitionKey,
     } else if (fieldIndex == 1) {
       outBaseDomain.Assign(field);
     } else if (fieldIndex == 2) {
-      // The first optional argument is either "f" or a port number
-      if (field.EqualsLiteral("f")) {
-        outForeignByAncestorContext = true;
-      } else {
-        // Parse the port which is represented in the partitionKey string as a
-        // decimal (base 10) number.
-        long port = strtol(NS_ConvertUTF16toUTF8(field).get(), nullptr, 10);
-        // Invalid port.
-        if (NS_WARN_IF(port == 0)) {
-          return false;
-        }
-        outPort = static_cast<int32_t>(port);
-      }
-    } else if (fieldIndex == 3) {
-      // The second optional argument, if it exists, is "f" and the first
-      // optional argument was a port
-      if (field.EqualsLiteral("f") || outPort == -1) {
-        NS_WARNING("Invalid partitionKey. Invalid token.");
+      // Parse the port which is represented in the partitionKey string as a
+      // decimal (base 10) number.
+      long port = strtol(NS_ConvertUTF16toUTF8(field).get(), nullptr, 10);
+      // Invalid port.
+      if (NS_WARN_IF(port == 0)) {
         return false;
       }
-      outForeignByAncestorContext = true;
+      outPort = static_cast<int32_t>(port);
     } else {
       NS_WARNING("Invalid partitionKey. Too many tokens");
       return false;
diff --git a/caps/OriginAttributes.h b/caps/OriginAttributes.h
index 52f7afa9427d..faf9d8005078 100644
--- a/caps/OriginAttributes.h
+++ b/caps/OriginAttributes.h
@@ -27,9 +27,9 @@ class OriginAttributes : public dom::OriginAttributesDictionary {
   void SetFirstPartyDomain(const bool aIsTopLevelDocument,
                            const nsAString& aDomain, bool aForced = false);
 
-  void SetPartitionKey(nsIURI* aURI, bool aForeignByAncestorContext);
-  void SetPartitionKey(const nsACString& aOther);
-  void SetPartitionKey(const nsAString& aOther);
+  void SetPartitionKey(nsIURI* aURI);
+  void SetPartitionKey(const nsACString& aDomain);
+  void SetPartitionKey(const nsAString& aDomain);
 
   enum {
     STRIP_FIRST_PARTY_DOMAIN = 0x01,
@@ -129,13 +129,13 @@ class OriginAttributes : public dom::OriginAttributesDictionary {
   // different than 0.
   static bool IsPrivateBrowsing(const nsACString& aOrigin);
 
-  // Parse a partitionKey of the format
-  // "(<scheme>,<baseDomain>,[port],[ancestorbit])" into its components. Returns
-  // false if the partitionKey cannot be parsed because the format is invalid.
+  // Parse a partitionKey of the format "(<scheme>,<baseDomain>,[port])" into
+  // its components.
+  // Returns false if the partitionKey cannot be parsed because the format is
+  // invalid.
   static bool ParsePartitionKey(const nsAString& aPartitionKey,
                                 nsAString& outScheme, nsAString& outBaseDomain,
-                                int32_t& outPort,
-                                bool& outForeignByAncestorContext);
+                                int32_t& outPort);
 };
 
 class OriginAttributesPattern : public dom::OriginAttributesPatternDictionary {
@@ -193,9 +193,8 @@ class OriginAttributesPattern : public dom::OriginAttributesPatternDictionary {
         nsString scheme;
         nsString baseDomain;
         int32_t port;
-        bool ancestor;
         bool success = OriginAttributes::ParsePartitionKey(
-            aAttrs.mPartitionKey, scheme, baseDomain, port, ancestor);
+            aAttrs.mPartitionKey, scheme, baseDomain, port);
         if (!success) {
           return false;
         }
@@ -211,10 +210,6 @@ class OriginAttributesPattern : public dom::OriginAttributesPatternDictionary {
         if (pkPattern.mPort.WasPassed() && pkPattern.mPort.Value() != port) {
           return false;
         }
-        if (pkPattern.mForeignByAncestorContext.WasPassed() &&
-            pkPattern.mForeignByAncestorContext.Value() != ancestor) {
-          return false;
-        }
       }
     }
 
@@ -267,12 +262,6 @@ class OriginAttributesPattern : public dom::OriginAttributesPatternDictionary {
           self.mPort.Value() != other.mPort.Value()) {
         return false;
       }
-      if (self.mForeignByAncestorContext.WasPassed() &&
-          other.mForeignByAncestorContext.WasPassed() &&
-          self.mForeignByAncestorContext.Value() !=
-              other.mForeignByAncestorContext.Value()) {
-        return false;
-      }
     }
 
     return true;
diff --git a/dom/base/ChromeUtils.cpp b/dom/base/ChromeUtils.cpp
index 407f33e04496..8d111c70bf70 100644
--- a/dom/base/ChromeUtils.cpp
+++ b/dom/base/ChromeUtils.cpp
@@ -1289,10 +1289,9 @@ void ChromeUtils::GetBaseDomainFromPartitionKey(dom::GlobalObject& aGlobal,
   nsString scheme;
   nsString pkBaseDomain;
   int32_t port;
-  bool ancestor;
 
-  if (!mozilla::OriginAttributes::ParsePartitionKey(
-          aPartitionKey, scheme, pkBaseDomain, port, ancestor)) {
+  if (!mozilla::OriginAttributes::ParsePartitionKey(aPartitionKey, scheme,
+                                                    pkBaseDomain, port)) {
     aRv.Throw(NS_ERROR_FAILURE);
     return;
   }
@@ -1318,10 +1317,7 @@ void ChromeUtils::GetPartitionKeyFromURL(dom::GlobalObject& aGlobal,
   }
 
   mozilla::OriginAttributes attrs;
-  // For now, uses assume the partition key is cross-site.
-  // We will need to not make this assumption to allow access
-  // to same-site partitioned cookies in the cookie extension API.
-  attrs.SetPartitionKey(uri, false);
+  attrs.SetPartitionKey(uri);
 
   aPartitionKey = attrs.mPartitionKey;
 }
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index 99dae97ca5cc..abcaecea9131 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -17516,18 +17516,6 @@ Document::CreatePermissionGrantPromise(
         p = new StorageAccessAPIHelper::StorageAccessPermissionGrantPromise::
             Private(__func__);
 
-    // Before we prompt, see if we are same-site
-    if (aFrameOnly) {
-      nsIChannel* channel = self->GetChannel();
-      if (channel) {
-        nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
-        if (!loadInfo->GetIsThirdPartyContextToTopWindow()) {
-          p->Resolve(StorageAccessAPIHelper::eAllow, __func__);
-          return p;
-        }
-      }
-    }
-
     RefPtr<PWindowGlobalChild::GetStorageAccessPermissionPromise> promise;
     // Test the permission
     MOZ_ASSERT(XRE_IsContentProcess());
diff --git a/dom/base/ThirdPartyUtil.cpp b/dom/base/ThirdPartyUtil.cpp
index 0ced8aa7d8ee..2c71ab3d946b 100644
--- a/dom/base/ThirdPartyUtil.cpp
+++ b/dom/base/ThirdPartyUtil.cpp
@@ -200,9 +200,9 @@ ThirdPartyUtil::IsThirdPartyWindow(mozIDOMWindowProxy* aWindow, nsIURI* aURI,
 
   bool result;
 
-  // Ignore about:blank and about:srcdoc URIs here since they have no domain
-  // and attempting to compare against them will fail.
-  if (aURI && !NS_IsAboutBlank(aURI) && !NS_IsAboutSrcdoc(aURI)) {
+  // Ignore about:blank URIs here since they have no domain and attempting to
+  // compare against them will fail.
+  if (aURI && !NS_IsAboutBlank(aURI)) {
     nsCOMPtr<nsIPrincipal> prin;
     nsresult rv = GetPrincipalFromWindow(aWindow, getter_AddRefs(prin));
     NS_ENSURE_SUCCESS(rv, rv);
@@ -320,10 +320,10 @@ ThirdPartyUtil::IsThirdPartyChannel(nsIChannel* aChannel, nsIURI* aURI,
     }
   }
 
-  // Special consideration must be done for about:blank and about:srcdoc URIs
-  // because those inherit the principal from the parent context. For them,
-  // let's consider the principal URI.
-  if (NS_IsAboutBlank(channelURI) || NS_IsAboutSrcdoc(channelURI)) {
+  // Special consideration must be done for about:blank URIs because those
+  // inherit the principal from the parent context. For them, let's consider the
+  // principal URI.
+  if (NS_IsAboutBlank(channelURI)) {
     nsCOMPtr<nsIPrincipal> principalToInherit =
         loadInfo->FindPrincipalToInherit(aChannel);
     if (!principalToInherit) {
diff --git a/dom/chrome-webidl/ChromeUtils.webidl b/dom/chrome-webidl/ChromeUtils.webidl
index e1a4c3bedf79..3ccb125a1e04 100644
--- a/dom/chrome-webidl/ChromeUtils.webidl
+++ b/dom/chrome-webidl/ChromeUtils.webidl
@@ -975,7 +975,6 @@ dictionary PartitionKeyPatternDictionary {
   DOMString scheme;
   DOMString baseDomain;
   long port;
-  boolean foreignByAncestorContext;
 };
 
 dictionary CompileScriptOptionsDictionary {
diff --git a/dom/indexedDB/test/test_third_party.html b/dom/indexedDB/test/test_third_party.html
index 439f50d75427..ee90de8dac60 100644
--- a/dom/indexedDB/test/test_third_party.html
+++ b/dom/indexedDB/test/test_third_party.html
@@ -25,12 +25,12 @@
       { host: "http://sub1.test2.example.org:8000", cookieBehavior: BEHAVIOR_REJECT, expectedResultFrame1: false, expectedResultFrame2: false },
 
       { host: "http://" + window.location.host, cookieBehavior: BEHAVIOR_REJECTFOREIGN, expectedResultFrame1: true, expectedResultFrame2: true },
-      { host: "http://example.com", cookieBehavior: BEHAVIOR_REJECTFOREIGN, expectedResultFrame1: false, expectedResultFrame2: false },
-      { host: "http://sub1.test2.example.org:8000", cookieBehavior: BEHAVIOR_REJECTFOREIGN, expectedResultFrame1: false, expectedResultFrame2: false },
+      { host: "http://example.com", cookieBehavior: BEHAVIOR_REJECTFOREIGN, expectedResultFrame1: false, expectedResultFrame2: true },
+      { host: "http://sub1.test2.example.org:8000", cookieBehavior: BEHAVIOR_REJECTFOREIGN, expectedResultFrame1: false, expectedResultFrame2: true },
 
       { host: "http://" + window.location.host, cookieBehavior: BEHAVIOR_LIMITFOREIGN, expectedResultFrame1: true, expectedResultFrame2: true },
-      { host: "http://example.com", cookieBehavior: BEHAVIOR_LIMITFOREIGN, expectedResultFrame1: false, expectedResultFrame2: false },
-      { host: "http://sub1.test2.example.org:8000", cookieBehavior: BEHAVIOR_LIMITFOREIGN, expectedResultFrame1: false, expectedResultFrame2: false },
+      { host: "http://example.com", cookieBehavior: BEHAVIOR_LIMITFOREIGN, expectedResultFrame1: false, expectedResultFrame2: true },
+      { host: "http://sub1.test2.example.org:8000", cookieBehavior: BEHAVIOR_LIMITFOREIGN, expectedResultFrame1: false, expectedResultFrame2: true },
     ];
 
     const iframe1Path =
diff --git a/dom/serviceworkers/ServiceWorkerPrivate.cpp b/dom/serviceworkers/ServiceWorkerPrivate.cpp
index 5d95452503e2..864a59800648 100644
--- a/dom/serviceworkers/ServiceWorkerPrivate.cpp
+++ b/dom/serviceworkers/ServiceWorkerPrivate.cpp
@@ -544,11 +544,10 @@ nsresult ServiceWorkerPrivate::Initialize() {
     nsAutoString scheme;
     nsAutoString pkBaseDomain;
     int32_t unused;
-    bool unused2;
 
     if (OriginAttributes::ParsePartitionKey(
             principal->OriginAttributesRef().mPartitionKey, scheme,
-            pkBaseDomain, unused, unused2)) {
+            pkBaseDomain, unused)) {
       nsCOMPtr<nsIURI> firstPartyURI;
       rv = NS_NewURI(getter_AddRefs(firstPartyURI),
                      scheme + u"://"_ns + pkBaseDomain);
@@ -593,8 +592,7 @@ nsresult ServiceWorkerPrivate::Initialize() {
       }
     }
   } else {
-    net::CookieJarSettings::Cast(cookieJarSettings)
-        ->SetPartitionKey(uri, false);
+    net::CookieJarSettings::Cast(cookieJarSettings)->SetPartitionKey(uri);
 
     // The service worker is for a first-party context, we can use the uri of
     // the service worker as the first-party domain to get the fingerprinting
diff --git a/dom/serviceworkers/ServiceWorkerScriptCache.cpp b/dom/serviceworkers/ServiceWorkerScriptCache.cpp
index 07635adbc567..f1569ffe5fad 100644
--- a/dom/serviceworkers/ServiceWorkerScriptCache.cpp
+++ b/dom/serviceworkers/ServiceWorkerScriptCache.cpp
@@ -678,8 +678,7 @@ nsresult CompareNetwork::Initialize(nsIPrincipal* aPrincipal,
     net::CookieJarSettings::Cast(cookieJarSettings)
         ->SetPartitionKey(aPrincipal->OriginAttributesRef().mPartitionKey);
   } else {
-    net::CookieJarSettings::Cast(cookieJarSettings)
-        ->SetPartitionKey(uri, false);
+    net::CookieJarSettings::Cast(cookieJarSettings)->SetPartitionKey(uri);
   }
 
   // Note that because there is no "serviceworker" RequestContext type, we can
diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp
index e5eeffeaa4c7..ecbf87646196 100644
--- a/dom/workers/ScriptLoader.cpp
+++ b/dom/workers/ScriptLoader.cpp
@@ -1063,8 +1063,8 @@ nsresult WorkerScriptLoader::LoadScript(
     // This flag reflects the fact that if the worker is created under a
     // third-party context.
     nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
-    loadInfo->SetIsInThirdPartyContext(
-        mWorkerRef->Private()->IsThirdPartyContext());
+    loadInfo->SetIsThirdPartyContextToTopWindow(
+        mWorkerRef->Private()->IsThirdPartyContextToTopWindow());
 
     Maybe<ClientInfo> clientInfo;
     clientInfo.emplace(loadContext->mClientInfo.ref());
diff --git a/dom/workers/WorkerLoadInfo.cpp b/dom/workers/WorkerLoadInfo.cpp
index 29fb69c2128d..0dec07a675c5 100644
--- a/dom/workers/WorkerLoadInfo.cpp
+++ b/dom/workers/WorkerLoadInfo.cpp
@@ -101,7 +101,7 @@ WorkerLoadInfoData::WorkerLoadInfoData()
       mUsingStorageAccess(false),
       mServiceWorkersTestingInWindow(false),
       mShouldResistFingerprinting(false),
-      mIsThirdPartyContext(true),
+      mIsThirdPartyContextToTopWindow(true),
       mSecureContext(eNotSet) {}
 
 nsresult WorkerLoadInfo::SetPrincipalsAndCSPOnMainThread(
diff --git a/dom/workers/WorkerLoadInfo.h b/dom/workers/WorkerLoadInfo.h
index c86538145cc8..722e71d6f3d5 100644
--- a/dom/workers/WorkerLoadInfo.h
+++ b/dom/workers/WorkerLoadInfo.h
@@ -147,7 +147,7 @@ struct WorkerLoadInfoData {
   bool mShouldResistFingerprinting;
   Maybe<RFPTarget> mOverriddenFingerprintingSettings;
   OriginAttributes mOriginAttributes;
-  bool mIsThirdPartyContext;
+  bool mIsThirdPartyContextToTopWindow;
 
   enum {
     eNotSet,
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 037b79c74e9a..3644851a7e1b 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -2791,7 +2791,8 @@ nsresult WorkerPrivate::GetLoadInfo(
     loadInfo.mOriginAttributes = aParent->GetOriginAttributes();
     loadInfo.mServiceWorkersTestingInWindow =
         aParent->ServiceWorkersTestingInWindow();
-    loadInfo.mIsThirdPartyContext = aParent->IsThirdPartyContext();
+    loadInfo.mIsThirdPartyContextToTopWindow =
+        aParent->IsThirdPartyContextToTopWindow();
     loadInfo.mShouldResistFingerprinting = aParent->ShouldResistFingerprinting(
         RFPTarget::IsAlwaysEnabledForPrecompute);
     loadInfo.mOverriddenFingerprintingSettings =
@@ -2952,7 +2953,7 @@ nsresult WorkerPrivate::GetLoadInfo(
           StorageAllowedForDocument(document) != StorageAccess::eAllow) {
         loadInfo.mUsingStorageAccess = false;
       }
-      loadInfo.mIsThirdPartyContext =
+      loadInfo.mIsThirdPartyContextToTopWindow =
           AntiTrackingUtils::IsThirdPartyWindow(globalWindow, nullptr);
       loadInfo.mCookieJarSettings = document->CookieJarSettings();
       if (loadInfo.mCookieJarSettings) {
@@ -3020,7 +3021,7 @@ nsresult WorkerPrivate::GetLoadInfo(
       cookieJarSettings->Serialize(loadInfo.mCookieJarSettingsArgs);
 
       loadInfo.mOriginAttributes = OriginAttributes();
-      loadInfo.mIsThirdPartyContext = false;
+      loadInfo.mIsThirdPartyContextToTopWindow = false;
     }
 
     MOZ_ASSERT(loadInfo.mLoadingPrincipal);
diff --git a/dom/workers/WorkerPrivate.h b/dom/workers/WorkerPrivate.h
index ce754ba9f6c2..a670d009759d 100644
--- a/dom/workers/WorkerPrivate.h
+++ b/dom/workers/WorkerPrivate.h
@@ -972,7 +972,9 @@ class WorkerPrivate final
   }
 
   // Determine if the worker was created under a third-party context.
-  bool IsThirdPartyContext() const { return mLoadInfo.mIsThirdPartyContext; }
+  bool IsThirdPartyContextToTopWindow() const {
+    return mLoadInfo.mIsThirdPartyContextToTopWindow;
+  }
 
   bool IsWatchedByDevTools() const { return mLoadInfo.mWatchedByDevTools; }
 
diff --git a/dom/workers/remoteworkers/RemoteWorkerChild.cpp b/dom/workers/remoteworkers/RemoteWorkerChild.cpp
index bf63c1729cf7..feb294f3fc2b 100644
--- a/dom/workers/remoteworkers/RemoteWorkerChild.cpp
+++ b/dom/workers/remoteworkers/RemoteWorkerChild.cpp
@@ -286,7 +286,7 @@ nsresult RemoteWorkerChild::ExecWorkerOnMainThread(RemoteWorkerData&& aData) {
   info.mStorageAccess = aData.storageAccess();
   info.mUseRegularPrincipal = aData.useRegularPrincipal();
   info.mUsingStorageAccess = aData.usingStorageAccess();
-  info.mIsThirdPartyContext = aData.isThirdPartyContext();
+  info.mIsThirdPartyContextToTopWindow = aData.isThirdPartyContextToTopWindow();
   info.mOriginAttributes =
       BasePrincipal::Cast(principal)->OriginAttributesRef();
   info.mShouldResistFingerprinting = aData.shouldResistFingerprinting();
diff --git a/dom/workers/remoteworkers/RemoteWorkerTypes.ipdlh b/dom/workers/remoteworkers/RemoteWorkerTypes.ipdlh
index 08fb5700feb0..8894450b72ba 100644
--- a/dom/workers/remoteworkers/RemoteWorkerTypes.ipdlh
+++ b/dom/workers/remoteworkers/RemoteWorkerTypes.ipdlh
@@ -76,7 +76,7 @@ struct RemoteWorkerData
 
   StorageAccess storageAccess;
 
-  bool isThirdPartyContext;
+  bool isThirdPartyContextToTopWindow;
 
   bool shouldResistFingerprinting;
 
diff --git a/netwerk/cookie/CookieJarSettings.cpp b/netwerk/cookie/CookieJarSettings.cpp
index 9e598c296f2f..027382b1ee19 100644
--- a/netwerk/cookie/CookieJarSettings.cpp
+++ b/netwerk/cookie/CookieJarSettings.cpp
@@ -4,11 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozIThirdPartyUtil.h"
 #include "mozilla/AntiTrackingUtils.h"
 #include "mozilla/BasePrincipal.h"
 #include "mozilla/ClearOnShutdown.h"
-#include "mozilla/Components.h"
 #include "mozilla/ContentBlockingAllowList.h"
 #include "mozilla/dom/BrowsingContext.h"
 #include "mozilla/net/CookieJarSettings.h"
@@ -17,7 +15,6 @@
 #include "mozilla/PermissionManager.h"
 #include "mozilla/SchedulerGroup.h"
 #include "mozilla/StaticPrefs_network.h"
-#include "mozilla/StoragePrincipalHelper.h"
 #include "mozilla/Unused.h"
 #include "nsIPrincipal.h"
 #if defined(MOZ_THUNDERBIRD) || defined(MOZ_SUITE)
@@ -199,7 +196,7 @@ CookieJarSettings::InitWithURI(nsIURI* aURI, bool aIsPrivate) {
 
   mCookieBehavior = nsICookieManager::GetCookieBehavior(aIsPrivate);
 
-  SetPartitionKey(aURI, false);
+  SetPartitionKey(aURI);
   return NS_OK;
 }
 
@@ -529,25 +526,14 @@ void CookieJarSettings::Merge(const CookieJarSettingsArgs& aData) {
   }
 }
 
-void CookieJarSettings::SetPartitionKey(nsIURI* aURI,
-                                        bool aForeignByAncestorContext) {
+void CookieJarSettings::SetPartitionKey(nsIURI* aURI) {
   MOZ_ASSERT(aURI);
 
   OriginAttributes attrs;
-  attrs.SetPartitionKey(aURI, aForeignByAncestorContext);
+  attrs.SetPartitionKey(aURI);
   mPartitionKey = std::move(attrs.mPartitionKey);
 }
 
-void CookieJarSettings::UpdatePartitionKeyForDocumentLoadedByChannel(
-    nsIChannel* aChannel) {
-  nsCOMPtr<nsILoadInfo> loadInfo = aChannel->LoadInfo();
-  bool thirdParty = AntiTrackingUtils::IsThirdPartyChannel(aChannel);
-  bool foreignByAncestorContext =
-      thirdParty && !loadInfo->GetIsThirdPartyContextToTopWindow();
-  StoragePrincipalHelper::UpdatePartitionKeyWithForeignAncestorBit(
-      mPartitionKey, foreignByAncestorContext);
-}
-
 void CookieJarSettings::UpdateIsOnContentBlockingAllowList(
     nsIChannel* aChannel) {
   MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess());
diff --git a/netwerk/cookie/CookieJarSettings.h b/netwerk/cookie/CookieJarSettings.h
index cf3c9ff41890..c1554175fb76 100644
--- a/netwerk/cookie/CookieJarSettings.h
+++ b/netwerk/cookie/CookieJarSettings.h
@@ -161,14 +161,12 @@ class CookieJarSettings final : public nsICookieJarSettings {
 
   void UpdateIsOnContentBlockingAllowList(nsIChannel* aChannel);
 
-  void SetPartitionKey(nsIURI* aURI, bool aForeignByAncestorContext);
+  void SetPartitionKey(nsIURI* aURI);
   void SetPartitionKey(const nsAString& aPartitionKey) {
     mPartitionKey = aPartitionKey;
   }
   const nsAString& GetPartitionKey() { return mPartitionKey; };
 
-  void UpdatePartitionKeyForDocumentLoadedByChannel(nsIChannel* aChannel);
-
   void SetFingerprintingRandomizationKey(const nsTArray<uint8_t>& aKey) {
     mFingerprintingRandomKey.reset();
 
diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp
index 768d08658c45..aeb6083fff88 100644
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -2423,6 +2423,7 @@ HttpBaseChannel::GetDocumentURI(nsIURI** aDocumentURI) {
 NS_IMETHODIMP
 HttpBaseChannel::SetDocumentURI(nsIURI* aDocumentURI) {
   ENSURE_CALLED_BEFORE_CONNECT();
+
   mDocumentURI = aDocumentURI;
   return NS_OK;
 }
diff --git a/netwerk/test/mochitests/test_different_domain_in_hierarchy.html b/netwerk/test/mochitests/test_different_domain_in_hierarchy.html
index 1a4abad676c7..0ec6d35d4d98 100644
--- a/netwerk/test/mochitests/test_different_domain_in_hierarchy.html
+++ b/netwerk/test/mochitests/test_different_domain_in_hierarchy.html
@@ -5,7 +5,7 @@
   <script src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
-<body onload="setupTest('https://example.org/tests/netwerk/test/mochitests/file_domain_hierarchy_inner.html', 3, 3)">
+<body onload="setupTest('https://example.org/tests/netwerk/test/mochitests/file_domain_hierarchy_inner.html', 4, 3)">
 <p id="display"></p>
 <pre id="test">
 <script class="testbody" type="text/javascript" src="file_testcommon.js">
diff --git a/testing/web-platform/meta/cookies/samesite/sandbox-iframe-nested.https.html.ini b/testing/web-platform/meta/cookies/samesite/sandbox-iframe-nested.https.html.ini
index 1e90702b7ae1..df011eaa4fb5 100644
--- a/testing/web-platform/meta/cookies/samesite/sandbox-iframe-nested.https.html.ini
+++ b/testing/web-platform/meta/cookies/samesite/sandbox-iframe-nested.https.html.ini
@@ -1,7 +1,3 @@
 [sandbox-iframe-nested.https.html]
   expected:
     if (os == "android") and fission: [OK, TIMEOUT]
-  [SameSite cookies with intervening sandboxed iframe and navigation]
-    expected:
-      if (os == "android") and fission: [FAIL, TIMEOUT]
-      [FAIL]
diff --git a/testing/web-platform/meta/cookies/samesite/sandbox-iframe-subresource.https.html.ini b/testing/web-platform/meta/cookies/samesite/sandbox-iframe-subresource.https.html.ini
index 00e334da5b57..e04cad06cc77 100644
--- a/testing/web-platform/meta/cookies/samesite/sandbox-iframe-subresource.https.html.ini
+++ b/testing/web-platform/meta/cookies/samesite/sandbox-iframe-subresource.https.html.ini
@@ -1,8 +1,3 @@
 [sandbox-iframe-subresource.https.html]
   expected:
     if (os == "android") and fission: [OK, TIMEOUT]
-
-  [SameSite cookies with intervening sandboxed iframe and subresources]
-    expected:
-      if (os == "android") and fission: [FAIL, TIMEOUT]
-      [FAIL]
diff --git a/testing/web-platform/meta/service-workers/service-worker/partitioned.tentative.https.html.ini b/testing/web-platform/meta/service-workers/service-worker/partitioned.tentative.https.html.ini
index 39e8ad1df2f3..6d267cda2a65 100644
--- a/testing/web-platform/meta/service-workers/service-worker/partitioned.tentative.https.html.ini
+++ b/testing/web-platform/meta/service-workers/service-worker/partitioned.tentative.https.html.ini
@@ -6,5 +6,4 @@
       if os == "android": FAIL
 
   [Services workers with cross-site ancestors are partitioned.]
-    expected:
-      if os == "android": FAIL
+    expected: FAIL
diff --git a/testing/web-platform/meta/storage-access-api/hasStorageAccess-ABA.tentative.sub.https.window.js.ini b/testing/web-platform/meta/storage-access-api/hasStorageAccess-ABA.tentative.sub.https.window.js.ini
index e12bcec89939..c182ff57d96a 100644
--- a/testing/web-platform/meta/storage-access-api/hasStorageAccess-ABA.tentative.sub.https.window.js.ini
+++ b/testing/web-platform/meta/storage-access-api/hasStorageAccess-ABA.tentative.sub.https.window.js.ini
@@ -1,2 +1,6 @@
 [hasStorageAccess-ABA.tentative.sub.https.window.html]
   expected: [OK, TIMEOUT]
+
+  [[ABA\] document.hasStorageAccess() should not be allowed by default unless in top-level frame or same-origin iframe.]
+    expected: FAIL
+
diff --git a/testing/web-platform/meta/storage-access-api/requestStorageAccess-cross-site-sibling-iframes.sub.https.window.js.ini b/testing/web-platform/meta/storage-access-api/requestStorageAccess-cross-site-sibling-iframes.sub.https.window.js.ini
new file mode 100644
index 000000000000..9c62490213c7
--- /dev/null
+++ b/testing/web-platform/meta/storage-access-api/requestStorageAccess-cross-site-sibling-iframes.sub.https.window.js.ini
@@ -0,0 +1,4 @@
+[requestStorageAccess-cross-site-sibling-iframes.sub.https.window.html]
+  [Cross-site sibling iframes should not be able to take advantage of the existing permission grant requested by others.]
+    expected: FAIL
+
diff --git a/testing/web-platform/meta/web-locks/partitioned-web-locks.tentative.https.html.ini b/testing/web-platform/meta/web-locks/partitioned-web-locks.tentative.https.html.ini
index 4345581d65ce..d2b72809b21b 100644
--- a/testing/web-platform/meta/web-locks/partitioned-web-locks.tentative.https.html.ini
+++ b/testing/web-platform/meta/web-locks/partitioned-web-locks.tentative.https.html.ini
@@ -9,11 +9,11 @@ prefs: [privacy.partition.always_partition_third_party_non_cookie_storage:true,
   [WebLocks of a nested iframe with a cross-site ancestor are partitioned]
     expected:
       if not debug and (os == "linux") and fission and not asan and not tsan: [FAIL, TIMEOUT, NOTRUN]
-      if not debug and (os == "linux") and fission and asan: [TIMEOUT, PASS, NOTRUN]
-      if not debug and (os == "win"): PASS
-      if not debug and (os == "mac"): PASS
-      if debug: PASS
-      [PASS, NOTRUN]
+      if not debug and (os == "linux") and fission and asan: [TIMEOUT, FAIL, NOTRUN]
+      if not debug and (os == "win"): FAIL
+      if not debug and (os == "mac"): FAIL
+      if debug: FAIL
+      [FAIL, NOTRUN]
 
   [WebLocks of an iframe under a 3rd-party site are partitioned]
     expected:
diff --git a/toolkit/components/antitracking/AntiTrackingUtils.cpp b/toolkit/components/antitracking/AntiTrackingUtils.cpp
index d9624237deb7..885ebb2534fd 100644
--- a/toolkit/components/antitracking/AntiTrackingUtils.cpp
+++ b/toolkit/components/antitracking/AntiTrackingUtils.cpp
@@ -825,8 +825,7 @@ void AntiTrackingUtils::ComputeIsThirdPartyToTopWindow(nsIChannel* aChannel) {
     // whether the page is third-party, so we use channel result principal
     // instead. By doing this, an the resource inherits the principal from
     // its parent is considered not a third-party.
-    if (NS_IsAboutBlank(uri) || NS_IsAboutSrcdoc(uri) ||
-        uri->SchemeIs("blob")) {
+    if (NS_IsAboutBlank(uri) || NS_IsAboutSrcdoc(uri)) {
       nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
       if (NS_WARN_IF(!ssm)) {
         return;
@@ -852,36 +851,10 @@ void AntiTrackingUtils::ComputeIsThirdPartyToTopWindow(nsIChannel* aChannel) {
 bool AntiTrackingUtils::IsThirdPartyChannel(nsIChannel* aChannel) {
   MOZ_ASSERT(aChannel);
 
-  // We have to handle blob URLs here because they always fail
-  // IsThirdPartyChannel because of how blob URLs are constructed. We just
-  // recompare to their ancestor chain from the loadInfo, bailing if any is
-  // third party.
-  nsAutoCString scheme;
-  nsCOMPtr<nsIURI> channelURI;
-  nsresult rv = aChannel->GetURI(getter_AddRefs(channelURI));
-  if (NS_SUCCEEDED(rv) && channelURI->SchemeIs("blob")) {
-    nsCOMPtr<nsILoadInfo> loadInfo = aChannel->LoadInfo();
-    for (const nsCOMPtr<nsIPrincipal>& principal :
-         loadInfo->AncestorPrincipals()) {
-      bool thirdParty = true;
-      rv = loadInfo->PrincipalToInherit()->IsThirdPartyPrincipal(principal,
-                                                                 &thirdParty);
-      if (NS_SUCCEEDED(rv) && thirdParty) {
-        return true;
-      }
-    }
-    return false;
-  }
-
-  nsCOMPtr<mozIThirdPartyUtil> tpuService =
-      mozilla::components::ThirdPartyUtil::Service();
-  if (!tpuService) {
-    return true;
-  }
-  bool thirdParty = true;
-  rv = tpuService->IsThirdPartyChannel(aChannel, nullptr, &thirdParty);
-  NS_ENSURE_SUCCESS(rv, true);
-  return thirdParty;
+  // We only care whether the channel is 3rd-party with respect to
+  // the top-level.
+  nsCOMPtr<nsILoadInfo> loadInfo = aChannel->LoadInfo();
+  return loadInfo->GetIsThirdPartyContextToTopWindow();
 }
 
 /* static */
@@ -934,29 +907,19 @@ bool AntiTrackingUtils::IsThirdPartyWindow(nsPIDOMWindowInner* aWindow,
 /* static */
 bool AntiTrackingUtils::IsThirdPartyDocument(Document* aDocument) {
   MOZ_ASSERT(aDocument);
-  nsCOMPtr<mozIThirdPartyUtil> tpuService =
-      mozilla::components::ThirdPartyUtil::Service();
-  if (!tpuService) {
-    return true;
-  }
-  bool thirdParty = true;
-  if (!aDocument->GetChannel() ||
-      aDocument->GetDocumentURI()->SchemeIs("blob")) {
+  if (!aDocument->GetChannel()) {
     // If we can't get the channel from the document, i.e. initial about:blank
     // page, we use the browsingContext of the document to check if it's in the
     // third-party context. If the browsing context is still not available, we
     // will treat the window as third-party.
-    // We also rely on IsThirdPartyContext for blob documents because the
-    // IsThirdPartyChannel check relies on getting the BaseDomain,
-    // which correctly fails for blobs URIs.
     RefPtr<BrowsingContext> bc = aDocument->GetBrowsingContext();
     return bc ? IsThirdPartyContext(bc) : true;
   }
 
-  nsresult rv = tpuService->IsThirdPartyChannel(aDocument->GetChannel(),
-                                                nullptr, &thirdParty);
-  NS_ENSURE_SUCCESS(rv, true);
-  return thirdParty;
+  // We only care whether the channel is 3rd-party with respect to
+  // the top-level.
+  nsCOMPtr<nsILoadInfo> loadInfo = aDocument->GetChannel()->LoadInfo();
+  return loadInfo->GetIsThirdPartyContextToTopWindow();
 }
 
 /* static */
@@ -964,47 +927,41 @@ bool AntiTrackingUtils::IsThirdPartyContext(BrowsingContext* aBrowsingContext) {
   MOZ_ASSERT(aBrowsingContext);
   MOZ_ASSERT(aBrowsingContext->IsInProcess());
 
-  // iframes with SANDBOX_ORIGIN are always third-party contexts
-  // because they are a unique origin
+  if (aBrowsingContext->IsTopContent()) {
+    return false;
+  }
+
+  // If the top browsing context is not in the same process, it's cross-origin.
+  if (!aBrowsingContext->Top()->IsInProcess()) {
+    return true;
+  }
+
   nsIDocShell* docShell = aBrowsingContext->GetDocShell();
   if (!docShell) {
     return true;
   }
   Document* doc = docShell->GetExtantDocument();
-  if (!doc || doc->GetSandboxFlags() & SANDBOXED_ORIGIN) {
+  if (!doc) {
     return true;
   }
   nsIPrincipal* principal = doc->NodePrincipal();
 
-  BrowsingContext* traversingParent = aBrowsingContext->GetParent();
-  while (traversingParent) {
-    // If the parent browsing context is not in the same process, it's
-    // cross-origin.
-    if (!traversingParent->IsInProcess()) {
-      return true;
-    }
-
-    nsIDocShell* parentDocShell = traversingParent->GetDocShell();
-    if (!parentDocShell) {
-      return true;
-    }
-    Document* parentDoc = parentDocShell->GetDocument();
-    if (!parentDoc || parentDoc->GetSandboxFlags() & SANDBOXED_ORIGIN) {
-      return true;
-    }
-    nsIPrincipal* parentPrincipal = parentDoc->NodePrincipal();
+  nsIDocShell* topDocShell = aBrowsingContext->Top()->GetDocShell();
+  if (!topDocShell) {
+    return true;
+  }
+  Document* topDoc = topDocShell->GetDocument();
+  if (!topDoc) {
+    return true;
+  }
+  nsIPrincipal* topPrincipal = topDoc->NodePrincipal();
 
-    auto* parentBasePrin = BasePrincipal::Cast(parentPrincipal);
-    bool isThirdParty = true;
+  auto* topBasePrin = BasePrincipal::Cast(topPrincipal);
+  bool isThirdParty = true;
 
-    parentBasePrin->IsThirdPartyPrincipal(principal, &isThirdParty);
-    if (isThirdParty) {
-      return true;
-    }
+  topBasePrin->IsThirdPartyPrincipal(principal, &isThirdParty);
 
-    traversingParent = traversingParent->GetParent();
-  }
-  return false;
+  return isThirdParty;
 }
 
 /* static */
@@ -1052,18 +1009,6 @@ void AntiTrackingUtils::UpdateAntiTrackingInfoForChannel(nsIChannel* aChannel) {
       ->MarkOverriddenFingerprintingSettingsAsSet();
 #endif
 
-  ExtContentPolicyType contentType = loadInfo->GetExternalContentPolicyType();
-  if (contentType == ExtContentPolicy::TYPE_DOCUMENT ||
-      contentType == ExtContentPolicy::TYPE_SUBDOCUMENT) {
-    nsCOMPtr<nsICookieJarSettings> cookieJarSettings;
-    Unused << loadInfo->GetCookieJarSettings(getter_AddRefs(cookieJarSettings));
-    // For subdocuments, the channel's partition key is that of the parent
-    // document. This document may have a different partition key, particularly
-    // one without the same-site bit.
-    net::CookieJarSettings::Cast(cookieJarSettings)
-        ->UpdatePartitionKeyForDocumentLoadedByChannel(aChannel);
-  }
-
   // We only update the IsOnContentBlockingAllowList flag and the partition key
   // for the top-level http channel.
   //
@@ -1074,15 +1019,17 @@ void AntiTrackingUtils::UpdateAntiTrackingInfoForChannel(nsIChannel* aChannel) {
   // The partition key is computed based on the site, so it's no point to set it
   // for channels other than http channels.
   nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(aChannel);
-  if (!httpChannel || contentType != ExtContentPolicy::TYPE_DOCUMENT) {
+  if (!httpChannel || loadInfo->GetExternalContentPolicyType() !=
+                          ExtContentPolicy::TYPE_DOCUMENT) {
     return;
   }
 
+  nsCOMPtr<nsICookieJarSettings> cookieJarSettings;
+  Unused << loadInfo->GetCookieJarSettings(getter_AddRefs(cookieJarSettings));
+
   // Update the IsOnContentBlockingAllowList flag in the CookieJarSettings
   // if this is a top level loading. For sub-document loading, this flag
   // would inherit from the parent.
-  nsCOMPtr<nsICookieJarSettings> cookieJarSettings;
-  Unused << loadInfo->GetCookieJarSettings(getter_AddRefs(cookieJarSettings));
   net::CookieJarSettings::Cast(cookieJarSettings)
       ->UpdateIsOnContentBlockingAllowList(aChannel);
 
@@ -1090,7 +1037,7 @@ void AntiTrackingUtils::UpdateAntiTrackingInfoForChannel(nsIChannel* aChannel) {
   // propagated to non-top level loads via CookieJarSetting.
   nsCOMPtr<nsIURI> uri;
   Unused << aChannel->GetURI(getter_AddRefs(uri));
-  net::CookieJarSettings::Cast(cookieJarSettings)->SetPartitionKey(uri, false);
+  net::CookieJarSettings::Cast(cookieJarSettings)->SetPartitionKey(uri);
 
   // Generate the fingerprinting randomization key for top-level loads. The key
   // will automatically be propagated to sub loads.
diff --git a/toolkit/components/antitracking/StorageAccessAPIHelper.cpp b/toolkit/components/antitracking/StorageAccessAPIHelper.cpp
index 8f040690c56e..5baa2c2557ae 100644
--- a/toolkit/components/antitracking/StorageAccessAPIHelper.cpp
+++ b/toolkit/components/antitracking/StorageAccessAPIHelper.cpp
@@ -1060,7 +1060,12 @@ StorageAccessAPIHelper::CheckSameSiteCallingContextDecidesStorageAccessAPI(
     }
   }
 
-  if (AntiTrackingUtils::IsThirdPartyDocument(aDocument)) {
+  nsIChannel* chan = aDocument->GetChannel();
+  if (!chan) {
+    return Some(false);
+  }
+  nsCOMPtr<nsILoadInfo> loadInfo = chan->LoadInfo();
+  if (loadInfo->GetIsThirdPartyContextToTopWindow()) {
     return Some(false);
   }
 
diff --git a/toolkit/components/antitracking/StoragePrincipalHelper.cpp b/toolkit/components/antitracking/StoragePrincipalHelper.cpp
index 79bafead2c13..10be1112ca69 100644
--- a/toolkit/components/antitracking/StoragePrincipalHelper.cpp
+++ b/toolkit/components/antitracking/StoragePrincipalHelper.cpp
@@ -86,10 +86,8 @@ bool ChooseOriginAttributes(nsIChannel* aChannel, OriginAttributes& aAttrs,
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return false;
   }
-  bool foreignByAncestorContext =
-      AntiTrackingUtils::IsThirdPartyChannel(aChannel) &&
-      !loadInfo->GetIsThirdPartyContextToTopWindow();
-  aAttrs.SetPartitionKey(principalURI, foreignByAncestorContext);
+
+  aAttrs.SetPartitionKey(principalURI);
   return true;
 }
 
@@ -315,7 +313,7 @@ nsresult StoragePrincipalHelper::GetPrincipal(nsIChannel* aChannel,
       // We only support foreign partitioned principal when dFPI is enabled.
       if (cjs->GetCookieBehavior() ==
               nsICookieService::BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN &&
-          AntiTrackingUtils::IsThirdPartyChannel(aChannel)) {
+          loadInfo->GetIsThirdPartyContextToTopWindow()) {
         outPrincipal = partitionedPrincipal;
       }
       break;
@@ -437,7 +435,7 @@ bool StoragePrincipalHelper::ShouldUsePartitionPrincipalForServiceWorker(
     return false;
   }
 
-  return aWorkerPrivate->IsThirdPartyContext();
+  return aWorkerPrivate->IsThirdPartyContextToTopWindow();
 }
 
 // static
@@ -481,7 +479,7 @@ bool StoragePrincipalHelper::GetOriginAttributes(
       // Otherwise, we will use the regular principal.
       if (cjs->GetCookieBehavior() ==
               nsICookieService::BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN &&
-          AntiTrackingUtils::IsThirdPartyChannel(aChannel)) {
+          loadInfo->GetIsThirdPartyContextToTopWindow()) {
         ChooseOriginAttributes(aChannel, aAttributes, true);
       }
       break;
@@ -562,7 +560,7 @@ void StoragePrincipalHelper::UpdateOriginAttributesForNetworkState(
     return;
   }
 
-  aAttributes.SetPartitionKey(aFirstPartyURI, false);
+  aAttributes.SetPartitionKey(aFirstPartyURI);
 }
 
 enum SupportedScheme { HTTP, HTTPS };
@@ -666,9 +664,8 @@ bool StoragePrincipalHelper::PartitionKeyHasBaseDomain(
   nsString scheme;
   nsString pkBaseDomain;
   int32_t port;
-  bool foreign;
-  bool success = OriginAttributes::ParsePartitionKey(
-      aPartitionKey, scheme, pkBaseDomain, port, foreign);
+  bool success = OriginAttributes::ParsePartitionKey(aPartitionKey, scheme,
+                                                     pkBaseDomain, port);
 
   if (!success) {
     return false;
@@ -677,26 +674,4 @@ bool StoragePrincipalHelper::PartitionKeyHasBaseDomain(
   return aBaseDomain.Equals(pkBaseDomain);
 }
 
-// static
-void StoragePrincipalHelper::UpdatePartitionKeyWithForeignAncestorBit(
-    nsAString& aKey, bool aForeignByAncestorContext) {
-  bool site = 0 == aKey.Find(u"(");
-  if (!site) {
-    return;
-  }
-  if (aForeignByAncestorContext) {
-    int32_t index = aKey.Find(u",f)");
-    if (index == -1) {
-      uint32_t cutStart = aKey.Length() - 1;
-      aKey.ReplaceLiteral(cutStart, 1, u",f)");
-    }
-  } else {
-    int32_t index = aKey.Find(u",f)");
-    if (index != -1) {
-      uint32_t cutLength = aKey.Length() - index;
-      aKey.ReplaceLiteral(index, cutLength, u")");
-    }
-  }
-}
-
 }  // namespace mozilla
diff --git a/toolkit/components/antitracking/StoragePrincipalHelper.h b/toolkit/components/antitracking/StoragePrincipalHelper.h
index 0fe362d8c1a4..f813417eb632 100644
--- a/toolkit/components/antitracking/StoragePrincipalHelper.h
+++ b/toolkit/components/antitracking/StoragePrincipalHelper.h
@@ -351,14 +351,6 @@ class StoragePrincipalHelper final {
 
   static bool PartitionKeyHasBaseDomain(const nsAString& aPartitionKey,
                                         const nsAString& aBaseDomain);
-
-  // Partition keys can have the same-site bit added or removed from them.
-  // "(https,foo.com)", false -> "(https,foo.com)"
-  // "(https,foo.com,f)", false -> "(https,foo.com)"
-  // "(https,foo.com,f)", true -> "(https,foo.com,f)"
-  // "(https,foo.com)", true -> "(https,foo.com,f)"
-  static void UpdatePartitionKeyWithForeignAncestorBit(
-      nsAString& aKey, bool aForeignByAncestorContext);
 };
 
 }  // namespace mozilla
diff --git a/toolkit/components/antitracking/test/browser/browser.toml b/toolkit/components/antitracking/test/browser/browser.toml
index 3e825f7b0c0c..fbc6d9addb37 100644
--- a/toolkit/components/antitracking/test/browser/browser.toml
+++ b/toolkit/components/antitracking/test/browser/browser.toml
@@ -112,8 +112,6 @@ skip-if = ["os == 'mac' && !debug"] # Bug 1503778, 1577362
 
 ["browser_onModifyRequestNotificationForTrackingResources.js"]
 
-["browser_partitionedABA.js"]
-
 ["browser_partitionedClearSiteDataHeader.js"]
 support-files = ["clearSiteData.sjs"]
 
diff --git a/toolkit/components/antitracking/test/browser/browser_doublyNestedTracker.js b/toolkit/components/antitracking/test/browser/browser_doublyNestedTracker.js
index c3b6342ce168..4f38b29a7dad 100644
--- a/toolkit/components/antitracking/test/browser/browser_doublyNestedTracker.js
+++ b/toolkit/components/antitracking/test/browser/browser_doublyNestedTracker.js
@@ -36,7 +36,7 @@ add_task(async function () {
     async function runChecks() {
       is(document.cookie, "", "No cookies for me");
       document.cookie = "name=value";
-      is(document.cookie, "", "I don't have the cookies!");
+      is(document.cookie, "name=value", "I have the cookies!");
     }
 
     await new Promise(resolve => {
diff --git a/toolkit/components/antitracking/test/browser/browser_partitionedABA.js b/toolkit/components/antitracking/test/browser/browser_partitionedABA.js
deleted file mode 100644
index b6acc82d4887..000000000000
--- a/toolkit/components/antitracking/test/browser/browser_partitionedABA.js
+++ /dev/null
@@ -1,86 +0,0 @@
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/*
- * A test to verify that ABA iframes partition at least localStorage and document.cookie
- */
-
-"use strict";
-
-add_setup(async function () {
-  await setCookieBehaviorPref(
-    BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN,
-    false
-  );
-});
-
-add_task(async function runTest() {
-  info("Creating the tab");
-  let tab = BrowserTestUtils.addTab(gBrowser, TEST_TOP_PAGE);
-  gBrowser.selectedTab = tab;
-
-  let browser = tab.linkedBrowser;
-  await BrowserTestUtils.browserLoaded(browser);
-
-  info("Creating the third-party iframe");
-  let ifrBC = await SpecialPowers.spawn(
-    browser,
-    [TEST_TOP_PAGE_7],
-    async page => {
-      let ifr = content.document.createElement("iframe");
-
-      let loading = ContentTaskUtils.waitForEvent(ifr, "load");
-      content.document.body.appendChild(ifr);
-      ifr.src = page;
-      await loading;
-
-      return ifr.browsingContext;
-    }
-  );
-
-  info("Creating the ABA iframe");
-  let ifrABABC = await SpecialPowers.spawn(
-    ifrBC,
-    [TEST_TOP_PAGE],
-    async page => {
-      let ifr = content.document.createElement("iframe");
-
-      let loading = ContentTaskUtils.waitForEvent(ifr, "load");
-      content.document.body.appendChild(ifr);
-      ifr.src = page;
-      await loading;
-
-      return ifr.browsingContext;
-    }
-  );
-
-  info("Write cookie to the ABA third-party iframe");
-  await SpecialPowers.spawn(ifrABABC, [], async _ => {
-    content.document.cookie = "foo; SameSite=None; Secure; Partitioned";
-  });
-
-  let cookie = await SpecialPowers.spawn(browser, [], async () => {
-    return content.document.cookie;
-  });
-  is(cookie, "", "Cookie is not in the top level");
-
-  info("Write localstorage to the ABA third-party iframe");
-  await SpecialPowers.spawn(ifrABABC, [], async _ => {
-    content.localStorage.setItem("foo", "bar");
-  });
-
-  let storage = await SpecialPowers.spawn(browser, [], async () => {
-    return content.localStorage.getItem("foo");
-  });
-  is(storage, null, "LocalStorage update is not in the top level");
-
-  info("Clean up");
-  BrowserTestUtils.removeTab(tab);
-  await new Promise(resolve => {
-    Services.clearData.deleteData(Ci.nsIClearDataService.CLEAR_ALL, () =>
-      resolve()
-    );
-  });
-});
diff --git a/toolkit/components/antitracking/test/browser/browser_storageAccessThirdPartyChecks_alwaysPartition.js b/toolkit/components/antitracking/test/browser/browser_storageAccessThirdPartyChecks_alwaysPartition.js
index 8ea97dac686e..f31c7893d0e0 100644
--- a/toolkit/components/antitracking/test/browser/browser_storageAccessThirdPartyChecks_alwaysPartition.js
+++ b/toolkit/components/antitracking/test/browser/browser_storageAccessThirdPartyChecks_alwaysPartition.js
@@ -53,7 +53,6 @@ AntiTracking._createTask({
     "https://tracking.example.org",
     "https://tracking.example.org",
     "https://tracking.example.org",
-    "https://another-tracking.example.net",
     "https://itisatracker.org",
   ],
 });
diff --git a/toolkit/components/resistfingerprinting/nsRFPService.cpp b/toolkit/components/resistfingerprinting/nsRFPService.cpp
index 6185366c7e37..a6c95eaea44a 100644
--- a/toolkit/components/resistfingerprinting/nsRFPService.cpp
+++ b/toolkit/components/resistfingerprinting/nsRFPService.cpp
@@ -19,7 +19,6 @@
 #include "MainThreadUtils.h"
 #include "ScopedNSSTypes.h"
 
-#include "mozilla/AntiTrackingUtils.h"
 #include "mozilla/ArrayIterator.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/Atomics.h"
@@ -1268,10 +1267,7 @@ Maybe<nsTArray<uint8_t>> nsRFPService::GenerateKey(nsIChannel* aChannel) {
 
   // Set the partitionKey using the top level URI to ensure that the key is
   // specific to the top level site.
-  bool foreignByAncestorContext =
-      AntiTrackingUtils::IsThirdPartyChannel(aChannel) &&
-      loadInfo->GetIsThirdPartyContextToTopWindow();
-  attrs.SetPartitionKey(topLevelURI, foreignByAncestorContext);
+  attrs.SetPartitionKey(topLevelURI);
 
   nsAutoCString oaSuffix;
   attrs.CreateSuffix(oaSuffix);
@@ -1341,14 +1337,8 @@ nsRFPService::CleanRandomKeyByPrincipal(nsIPrincipal* aPrincipal) {
 
   OriginAttributes attrs = aPrincipal->OriginAttributesRef();
   nsCOMPtr<nsIURI> uri = aPrincipal->GetURI();
+  attrs.SetPartitionKey(uri);
 
-  attrs.SetPartitionKey(uri, false);
-  ClearBrowsingSessionKey(attrs);
-
-  // We must also include the cross-site embeds of this principal that end up
-  // re-embedded back into the same principal's top level, otherwise state will
-  // persist for this target
-  attrs.SetPartitionKey(uri, true);
   ClearBrowsingSessionKey(attrs);
   return NS_OK;
 }
@@ -1364,21 +1354,14 @@ nsRFPService::CleanRandomKeyByDomain(const nsACString& aDomain) {
 
   // Use the originAttributes to get the partitionKey.
   OriginAttributes attrs;
-  attrs.SetPartitionKey(httpURI, false);
+  attrs.SetPartitionKey(httpURI);
 
   // Create a originAttributesPattern and set the http partitionKey to the
   // pattern.
   OriginAttributesPattern pattern;
   pattern.mPartitionKey.Reset();
   pattern.mPartitionKey.Construct(attrs.mPartitionKey);
-  ClearBrowsingSessionKey(pattern);
 
-  // We must also include the cross-site embeds of this principal that end up
-  // re-embedded back into the same principal's top level, otherwise state will
-  // persist for this target
-  attrs.SetPartitionKey(httpURI, true);
-  pattern.mPartitionKey.Reset();
-  pattern.mPartitionKey.Construct(attrs.mPartitionKey);
   ClearBrowsingSessionKey(pattern);
 
   // Get https URI from the domain.
@@ -1387,17 +1370,10 @@ nsRFPService::CleanRandomKeyByDomain(const nsACString& aDomain) {
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Use the originAttributes to get the partitionKey and set to the pattern.
-  attrs.SetPartitionKey(httpsURI, false);
+  attrs.SetPartitionKey(httpsURI);
   pattern.mPartitionKey.Reset();
   pattern.mPartitionKey.Construct(attrs.mPartitionKey);
-  ClearBrowsingSessionKey(pattern);
 
-  // We must also include the cross-site embeds of this principal that end up
-  // re-embedded back into the same principal's top level, otherwise state will
-  // persist for this target
-  attrs.SetPartitionKey(httpsURI, true);
-  pattern.mPartitionKey.Reset();
-  pattern.mPartitionKey.Construct(attrs.mPartitionKey);
   ClearBrowsingSessionKey(pattern);
   return NS_OK;
 }
@@ -1419,7 +1395,7 @@ nsRFPService::CleanRandomKeyByHost(const nsACString& aHost,
 
   // Use the originAttributes to get the partitionKey.
   OriginAttributes attrs;
-  attrs.SetPartitionKey(httpURI, false);
+  attrs.SetPartitionKey(httpURI);
 
   // Set the partitionKey to the pattern.
   pattern.mPartitionKey.Reset();
@@ -1427,31 +1403,16 @@ nsRFPService::CleanRandomKeyByHost(const nsACString& aHost,
 
   ClearBrowsingSessionKey(pattern);
 
-  // We must also include the cross-site embeds of this principal that end up
-  // re-embedded back into the same principal's top level, otherwise state will
-  // persist for this target
-  attrs.SetPartitionKey(httpURI, true);
-  pattern.mPartitionKey.Reset();
-  pattern.mPartitionKey.Construct(attrs.mPartitionKey);
-  ClearBrowsingSessionKey(pattern);
-
   // Get https URI from the host.
   nsCOMPtr<nsIURI> httpsURI;
   rv = NS_NewURI(getter_AddRefs(httpsURI), "https://"_ns + aHost);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Use the originAttributes to get the partitionKey and set to the pattern.
-  attrs.SetPartitionKey(httpsURI, false);
+  attrs.SetPartitionKey(httpsURI);
   pattern.mPartitionKey.Reset();
   pattern.mPartitionKey.Construct(attrs.mPartitionKey);
-  ClearBrowsingSessionKey(pattern);
 
-  // We must also include the cross-site embeds of this principal that end up
-  // re-embedded back into the same principal's top level, otherwise state will
-  // persist for this target
-  attrs.SetPartitionKey(httpsURI, true);
-  pattern.mPartitionKey.Reset();
-  pattern.mPartitionKey.Construct(attrs.mPartitionKey);
   ClearBrowsingSessionKey(pattern);
   return NS_OK;
 }
@@ -2050,7 +2011,7 @@ Maybe<RFPTarget> nsRFPService::GetOverriddenFingerprintingSettingsForChannel(
   }
 
   // The channel is for the first-party load.
-  if (!AntiTrackingUtils::IsThirdPartyChannel(aChannel)) {
+  if (!loadInfo->GetIsThirdPartyContextToTopWindow()) {
     return GetOverriddenFingerprintingSettingsForURI(uri, nullptr);
   }
 
@@ -2093,9 +2054,8 @@ Maybe<RFPTarget> nsRFPService::GetOverriddenFingerprintingSettingsForChannel(
     nsAutoString scheme;
     nsAutoString domain;
     int32_t unused;
-    bool unused2;
     if (!OriginAttributes::ParsePartitionKey(partitionKey, scheme, domain,
-                                             unused, unused2)) {
+                                             unused)) {
       MOZ_ASSERT(false);
       return Nothing();
     }
@@ -2136,16 +2096,12 @@ Maybe<RFPTarget> nsRFPService::GetOverriddenFingerprintingSettingsForChannel(
   cookieJarSettings->GetPartitionKey(partitionKey);
 
   OriginAttributes attrs;
-  attrs.SetPartitionKey(topURI, false);
-
-  OriginAttributes attrsForeignByAncestor;
-  attrsForeignByAncestor.SetPartitionKey(topURI, true);
+  attrs.SetPartitionKey(topURI);
 
   // The partitionKey of the channel could haven't been set here if the loading
   // channel is top-level.
   MOZ_ASSERT_IF(!partitionKey.IsEmpty(),
-                attrs.mPartitionKey.Equals(partitionKey) ||
-                    attrsForeignByAncestor.mPartitionKey.Equals(partitionKey));
+                attrs.mPartitionKey.Equals(partitionKey));
 #endif
 
   return GetOverriddenFingerprintingSettingsForURI(topURI, uri);
-- 
2.11.4.GIT