Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1abac9ea0f026da69102d5abd5199a81a1d1b650
https://github.com/WebKit/WebKit/commit/1abac9ea0f026da69102d5abd5199a81a1d1b650
Author: Chris Dumez <[email protected]>
Date: 2026-06-26 (Fri, 26 Jun 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm
Log Message:
-----------
WebContent process termination due to MESSAGE_CHECK in
WebProcessProxy::didPostMessage()
https://bugs.webkit.org/show_bug.cgi?id=317910
rdar://178596735
Reviewed by Alex Christensen.
WebProcessProxy::didPostMessage() MESSAGE_CHECKs that the page the message is
posted to is associated with the sending WebContent process (added in
314178@main). WebPageProxy::close() synchronously calls
WebProcessProxy::removeWebPage(), which disassociates the page from the
process, but defers sending Messages::WebPage::Close to the next run loop
iteration to avoid a white flash. Marking the page as pending-close happened
inside sendPageCloseMessage(), so it was deferred along with the Close message.
This left a window: after removeWebPage() but before the deferred Close ran,
the page was in neither WebProcessProxy's page maps nor m_pagesPendingClose.
An in-flight DidPostMessage IPC (e.g. a window.webkit.messageHandlers post from
a content script during teardown) dispatched in that window would fail the
MESSAGE_CHECK and terminate an otherwise well-behaved WebContent process.
Mark every content process for the page as pending-close synchronously in
close(), at the same time as removeWebPage(), and only clear the marker once
the deferred WebPage::Close async reply arrives. isAssociatedWithPage() already
consults m_pagesPendingClose, so the page stays associated for the whole
teardown.
Test: WKUserContentController.PostMessageDuringPageClose
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::close):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::addPagePendingClose):
(WebKit::WebProcessProxy::removePagePendingClose):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:
(TEST(WKUserContentController, PostMessageDuringPageClose)):
Canonical link: https://commits.webkit.org/315907@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
