Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d4da139b10fcbc01fb1876b909bbadbf52c1cccb
https://github.com/WebKit/WebKit/commit/d4da139b10fcbc01fb1876b909bbadbf52c1cccb
Author: Basuke Suzuki <[email protected]>
Date: 2026-06-24 (Wed, 24 Jun 2026)
Changed paths:
A
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal-expected.txt
A
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal.html
M Source/WebCore/history/HistoryItem.h
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/FrameLoader.h
M Source/WebCore/loader/HistoryController.cpp
M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
M Source/WebKit/UIProcess/ProvisionalPageProxy.h
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Source/WebKit/UIProcess/WebBackForwardList.h
M Source/WebKit/UIProcess/WebBackForwardList.swift
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
M Source/WebKit/WebProcess/WebPage/WebHistoryItemClient.cpp
M Source/WebKit/WebProcess/WebPage/WebHistoryItemClient.h
Log Message:
-----------
[Site Isolation] UIProcess authoritative for iframe client-redirect BF list
updates under UseUIProcessForBackForwardItemLoading
https://bugs.webkit.org/show_bug.cgi?id=317044
rdar://179526448
Reviewed by Sihui Liu.
Under UseUIProcessForBackForwardItemLoading, an iframe client redirect mutates
HistoryItem in place inside the WebProcess. The per-field BackForwardUpdateItem
IPC the mutation triggers races with the navigation commit at the UIProcess
sink — identifier-mismatch drops leave the BF list child URL stale.
Make UIProcess the authority for the iframe BF child FrameState update.
WebProcess side. HistoryItemClient gains a new virtual
ignoreChangesForScopeDuringRedirect(LocalFrame&) that callers wrap around the
in-place HistoryItem replace; it returns a ScopeExit<CompletionHandler<void()>>
that runs its cleanup at the end of the caller's scope. The default returns
a no-op scope; WebKit's WebHistoryItemClient overrides it to delegate to the
existing ignoreChangesForScope() (flipping m_shouldIgnoreChanges) when
useUIProcessForBackForwardItemLoading is on and the frame is non-main,
suppressing the per-field BackForwardUpdateItem IPCs that would otherwise
race. WebCore does not check the WK2 flag itself — the process-model policy
lives entirely on the WebKit side.
UIProcess side. The DidCommitLoadForFrame IPC carries one new optional
parameter: RefPtr<FrameState> redirectReplaceFrameState. WebProcess populates
it (via toFrameState on the freshly-mutated HistoryItem) only when the commit
is the iframe in-place replace; that condition is captured by a new
FrameLoader::shouldReplaceHistoryItemInChildFrame() predicate so the
multi-condition check (loadType == RedirectWithLockedBackForwardList,
non-main frame, documentLoader->isClientRedirect()) lives next to the other
related FrameLoader state. The recursive children of toFrameState are
stripped at the sender; the UIProcess receiver MESSAGE_CHECKs that the
incoming FrameState has no children before applying. didCommitLoadForFrame
applies the FrameState via a new
WebBackForwardList::replaceFrameStateForChild that calls
WebBackForwardListFrameItem::setFrameState wholesale — every regenerated
field (urlString, originalURLString, documentSequenceNumber,
itemSequenceNumber, navigationAPIKey, etc.) flows in one coherent payload
on the same IPC UIProcess already uses to drive its commit-time logic.
m_children on the FrameItem is preserved (setFrameState clears the incoming
children to avoid colliding with the FrameItem's own m_children store).
The Swift counterpart in WebBackForwardList.swift mirrors the C++ semantics.
The earlier urlString-only WebBackForwardListSwiftUtilities helper
(replaceFrameItemURL) is removed — setFrameState is called directly.
Drive-by: HistoryController::updateForRedirectWithLockedBackForwardList no
longer calls updateCurrentItem when m_frame->page() is null. The surrounding
client-redirect logic is page-aware and a page-less call had no observable
effect (mutating an orphaned m_currentItem with no client-visible side
effects).
Layout-test regression coverage is added at
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal.html
as a focused copy of the upstream WPT cluster test pinning both
SiteIsolationEnabled=true and UseUIProcessForBackForwardItemLoading=true via
the webkit-test-runner header. Only the back-direction subtest is included
here; the other three subtests need the dead-frame skip follow-up to
https://bugs.webkit.org/show_bug.cgi?id=317090 to avoid timing out, and are
added by that commit.
Without this fix, the back-direction subtest reports
FAIL ... assert_equals: first load event must be going back expected "?1" but
got ""
because the iframe URL update from the client redirect never reaches UIProcess.
Covered by existing SiteIsolation.* API tests that exercise iframe URL
rewriting under the flag (these continue to pass — they verify
regression-freeness rather than demonstrating the fix; the API-test path
enables UseUIProcessForBackForwardItemLoading automatically through
WebProcessPool::createWebPage when SiteIsolation is on):
- CanGoBackAfterLoadingAndNavigatingFrame
- BackNavigationOverCrossSiteIframeWithoutBFCache
- NavigateNestedIframeSameOriginBackForward
*
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal.html:
Added.
* Source/WebCore/history/HistoryItem.h:
(WebCore::HistoryItemClient::ignoreChangesForScopeDuringRedirect):
* Source/WebCore/loader/FrameLoader.h:
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::shouldReplaceHistoryItemInChildFrame):
* Source/WebCore/loader/HistoryController.cpp:
(WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
* Source/WebKit/UIProcess/ProvisionalPageProxy.h:
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::didCommitLoadForFrame):
* Source/WebKit/UIProcess/WebBackForwardList.h:
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::replaceFrameStateForChild):
* Source/WebKit/UIProcess/WebBackForwardList.swift:
* Source/WebKit/UIProcess/WebBackForwardListSwiftUtilities.h:
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::commitProvisionalFrame):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::commitProvisionalPage):
(WebKit::WebPageProxy::didCommitLoadForFrame):
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:
(WebKit::WebLocalFrameLoaderClient::dispatchDidCommitLoad):
* Source/WebKit/WebProcess/WebPage/WebHistoryItemClient.h:
* Source/WebKit/WebProcess/WebPage/WebHistoryItemClient.cpp:
(WebKit::WebHistoryItemClient::ignoreChangesForScopeDuringRedirect):
Canonical link: https://commits.webkit.org/315779@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
