Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: db01478790f15df74389fcec237abc0417c65ec3
https://github.com/WebKit/WebKit/commit/db01478790f15df74389fcec237abc0417c65ec3
Author: Brandon Stewart <[email protected]>
Date: 2026-06-22 (Mon, 22 Jun 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/inspector/page/network-manager-dynamic-cross-origin-frame-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/page/network-manager-dynamic-cross-origin-frame.html
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h
M Source/WebKit/UIProcess/Inspector/WebPageInspectorController.cpp
Log Message:
-----------
[Site Isolation] Report genuine cross-origin frame removal in
Page.frameDetached
https://bugs.webkit.org/show_bug.cgi?id=316668
rdar://179117697
Reviewed by BJ Burg.
The UIProcess ProxyingPageAgent suppressed the WebContent-process frameDetached
IPC whenever the frame was still in the WebFrameProxy registry, to avoid
removing
a live frame on a cross-origin process swap (the swap tears down the old
LocalFrame and fires frameDetached, but the frame persists). That heuristic was
over-broad: a genuine cross-origin frame removal also fires frameDetached while
the WebFrameProxy is momentarily still registered, so real removals were
silently
dropped and the frame lingered in WI.networkManager.frames forever.
The authoritative "frame is genuinely gone" signal is the destruction of the
UIProcess WebFrameProxy, which outlives process swaps and is destroyed only on
real removal. Report frameDetached from there (WebPageInspectorController::
willDestroyFrame -> ProxyingPageAgent::frameDestroyed), and make the
WebContent-process frameDetached IPC a no-op under Site Isolation (it cannot
distinguish a swap from a removal). The protocol id is computed while the frame
is still in the registry, matching the id used by frameNavigated.
Resolves the removal-ordering open question; covered by the new
network-manager-dynamic-cross-origin-frame.html test (add then genuine remove).
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h:
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp:
(Inspector::ProxyingPageAgent::frameDetached):
(Inspector::ProxyingPageAgent::frameDestroyed):
Make the WebContent-process frameDetached IPC a no-op under Site Isolation (it
cannot
distinguish a process swap from a genuine removal) and report genuine removals
from the
new frameDestroyed() instead.
* Source/WebKit/UIProcess/Inspector/WebPageInspectorController.cpp:
(WebKit::WebPageInspectorController::willDestroyFrame):
Call frameDestroyed() from the WebFrameProxy destruction path -- the
authoritative
"frame is genuinely gone" signal, which never fires on a process swap.
*
LayoutTests/http/tests/site-isolation/inspector/page/network-manager-dynamic-cross-origin-frame.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/page/network-manager-dynamic-cross-origin-frame-expected.txt:
Added.
Assert a dynamically-added cross-origin frame survives the spurious process-swap
frameDetached and that a genuine removal then fires frameDidDetach and drops it
from the
frame model.
Canonical link: https://commits.webkit.org/315602@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
