Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5b2c8a7befcd089b1ab0393948036625913aebb4
https://github.com/WebKit/WebKit/commit/5b2c8a7befcd089b1ab0393948036625913aebb4
Author: Sihui Liu <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Source/WebKit/UIProcess/WebBackForwardList.swift
M Source/WebKit/UIProcess/WebBackForwardListSwiftUtilities.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M TestExpectations/apitests
Log Message:
-----------
REGRESSION(315516@main): [iOS] TestWebKitAPI.SiteIsolation tests are flaky
timeout
https://bugs.webkit.org/show_bug.cgi?id=317676
rdar://180432846
Reviewed by Basuke Suzuki.
Fix two issues exposed or caused by 315516@main, which led Site Isolation tests
to fail on macOS Golden Gate:
1. Iterating WTF::Vectors of Ref<T>-bearing elements from Swift via
CxxVectorIterator hits rdar://173815363: Swift
mishandles destruction of Ref<T> elements during iteration, producing
assertions like "ASSERTION FAILED: m_ptr" in
Ref<FrameState>::get(). Two such loops in WebBackForwardList.swift were
affected:
- setBackForwardItemIdentifier(frameState:itemID:) iterating
frameState.children (a Vector<Ref<FrameState>>)
- restoreFromState(backForwardListState:) iterating backForwardListState.items
(a Vector<BackForwardListItemState>,
whose elements transitively hold a Ref<FrameState>)
To fix it, move both iterations into C++ helpers, mirroring the existing
workaround pattern set by 310371@main for
setBackForwardItemIdentifiers.
2. After session restore with andNavigate:YES, restoreFromSessionState calls
goToBackForwardItem(currentItem). Under
useUIProcessForBackForwardItemLoading, the per-frame walk introduced by
315516@main compares currentItem.mainFrameItem()
to item.mainFrameItem() — the same object — finds no per-frame
itemSequenceNumber / documentSequenceNumber diff,
dispatches no GoToBackForwardItem message, and only logs an error. The
WebProcess never loads anything and the session
restore tests time out.
To fix it, Add an IsSessionRestoreNavigation parameter to goToBackForwardItem
and pass Yes from restoreFromSessionState.
When the walk dispatches no message, force a single GoToBackForwardItem on the
target's main frame if there is no
current item OR the call is from session restore. Otherwise (e.g. a redundant
go(to: currentlyLoadedItem) call, or
Back-forward list corruption that produced identical sequence numbers across
distinct items) the walk's verdict is
trustworthy: log the existing error and drop. The fallback uses
sendGoToBackForwardItemForFrame to stay within the
per-frame dispatch model and re-resolve the destination process for the target
frame.
There is a drive-by fix to keep frameStateRef bound across
completeFrameStateForNavigation so ARC keeps the underlying
FrameState alive across the subsequent calls; relying on the temporary Ref's
lifetime would require Swift to auto-retain
the Foreign Reference Type returned from .ptr(), which isn't guaranteed.
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(setFrameStateBackForwardItemIdentifier):
(createItemsFromState):
(itemAtIndexInBackForwardListItemVector):
* Source/WebKit/UIProcess/WebBackForwardList.swift:
(MakeAPIArray.restoreFromState(_:)):
(MakeAPIArray.setBackForwardItemIdentifier(_:itemID:)):
(MakeAPIArray.completeFrameStateForNavigation(_:)):
* Source/WebKit/UIProcess/WebBackForwardListSwiftUtilities.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::goToBackForwardItem):
(WebKit::WebPageProxy::restoreFromSessionState):
* Source/WebKit/UIProcess/WebPageProxy.h:
* TestExpectations/apitests:
Canonical link: https://commits.webkit.org/315817@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
