Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 70105ea38f3a66d38594250c3d5016c29976ccc5
https://github.com/WebKit/WebKit/commit/70105ea38f3a66d38594250c3d5016c29976ccc5
Author: Basuke Suzuki <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
M Source/WebKit/Shared/SessionState.cpp
M Source/WebKit/Shared/SessionState.h
M Source/WebKit/Shared/WebBackForwardListFrameItem.cpp
M Source/WebKit/Shared/WebBackForwardListFrameItem.h
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Source/WebKit/UIProcess/WebBackForwardList.swift
Log Message:
-----------
[Site Isolation] Replace FrameState payload in place instead of swapping the
whole struct
https://bugs.webkit.org/show_bug.cgi?id=317857
rdar://180635604
Reviewed by Sihui Liu.
WebBackForwardListFrameItem registers itself in the process-wide allItems()
map at construction under the key {m_frameState->frameItemID,
m_frameState->itemID}; the destructor reads the same key to assert
identity and remove the entry. The constructor overrides
m_frameState->itemID with the owning WebBackForwardListItem's identifier
(the UIProcess-authoritative value), so the registration key is stable
for the FrameItem's lifetime as long as those two FrameState fields are
not later mutated.
setFrameState was implemented as a wholesale replacement of m_frameState
with an incoming FrameState regenerated by the WebProcess from its own
HistoryItem. The WebProcess iframe HistoryItem carries process-local
identifiers, and its m_itemID does not necessarily match the
WebBackForwardListItem identifier of the UIProcess BF list entry that
owns this child FrameItem (the same iframe HistoryItem can be referenced
across multiple BF list entries with distinct itemIDs UIProcess-side).
Letting the wholesale replace through clobbered the registered identity;
the destructor's allItems() lookup then returned null or a different
pointer and the assertion at line 58 fired:
ASSERTION FAILED: allItems().get({ *m_frameState->frameItemID,
*m_frameState->itemID }) == this
Source/WebKit/Shared/WebBackForwardListFrameItem.cpp(58) :
WebKit::WebBackForwardListFrameItem::~WebBackForwardListFrameItem()
with the cascade rooted at WebBackForwardList::addItem forward-list
eviction.
Stop swapping the whole FrameState. Add FrameState::replacePayloadFrom,
which moves every payload field (URL, sequence numbers, scroll, title,
documentState, etc.) from the source onto the destination but leaves
frameItemID, itemID, and children alone — the identity fields are fixed
at construction by the surrounding WebBackForwardListFrameItem, and
children is maintained in parallel on WebBackForwardListFrameItem::m_children.
WebBackForwardListFrameItem::setFrameState is renamed to
updateFrameStatePayload to reflect the partial-update semantics and is a
one-liner that delegates to replacePayloadFrom. The children.clear()
that used to undo the wholesale swap is no longer needed.
Covered by existing site-isolation tests; the EWS macOS Debug flake at
http/tests/site-isolation/frame-index.html previously reported as this
assertion stops firing with this change.
* Source/WebKit/Shared/SessionState.h:
(WebKit::FrameState::replacePayloadFrom):
* Source/WebKit/Shared/SessionState.cpp:
(WebKit::FrameState::replacePayloadFrom):
* Source/WebKit/Shared/WebBackForwardListFrameItem.h:
* Source/WebKit/Shared/WebBackForwardListFrameItem.cpp:
(WebKit::WebBackForwardListFrameItem::updateFrameStatePayload):
(WebKit::WebBackForwardListFrameItem::setFrameState): Deleted.
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::backForwardUpdateItem):
(WebKit::WebBackForwardList::replaceFrameStateForChild):
* Source/WebKit/UIProcess/WebBackForwardList.swift:
Canonical link: https://commits.webkit.org/315858@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
