Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e651f7053f95c26c76e6bc4a112d1385a7a56f37
https://github.com/WebKit/WebKit/commit/e651f7053f95c26c76e6bc4a112d1385a7a56f37
Author: Basuke Suzuki <[email protected]>
Date: 2026-06-26 (Fri, 26 Jun 2026)
Changed paths:
M
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal-expected.txt
M
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal.html
M LayoutTests/platform/mac-wk2/TestExpectations
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
Log Message:
-----------
[Site Isolation] Per-frame back/forward walk dispatches to dead BF frame
items, navigating main frame to iframe URL
https://bugs.webkit.org/show_bug.cgi?id=317799
rdar://180568019
Reviewed by Sihui Liu.
Follow-up to 315516@main (https://bugs.webkit.org/show_bug.cgi?id=317090,
walk-as-replacement).
WebPageProxy::dispatchPerFrameTraversals walks every frame in the target
back/forward item's tree and, through sendGoToBackForwardItemForFrame,
dispatches GoToBackForwardItem to each frame whose itemSequenceNumber
differs. The BF tree retains FrameState entries for iframes that have since
been removed from the DOM (e.g. an iframe a previous test created and tore
down via t.add_cleanup). For those dead slots
WebProcess::singleton().webFrame(frameID) returns null at the WebPage
receiver, and WebPage::goToBackForwardItem falls back to m_mainFrame — so
the main frame ends up navigating to the dead iframe's URL. In the WPT
cluster test cross-document-traversal-cross-document-traversal.html this
manifests as the test page itself being navigated to ?1 partway through
subtest 4, killing the test harness and timing out all subtests.
For child-frame BF items, have sendGoToBackForwardItemForFrame resolve the
target frameID to a live WebFrameProxy belonging to this page before
sending, and skip dispatch — returning false — when it does not. Propagate
that result as a bool through dispatchPerFrameTraversals and
goToBackForwardItem's anySent bookkeeping, so a walk whose only differing
frames are dead now sends nothing and falls through to the existing
"silently dropped" release-log warning instead of mis-navigating the main
frame. The check is gated on targetFrame.parent() so it applies only to
iframe BF items: a main-frame BF item's stale frameID is expected after
session restore to a new WebView (the BF list is hydrated with the
originating page's frameIDs before this page's main frame loads), and the
WebProcess receiver's m_mainFrame fallback is the correct destination for
the main frame — skipping would silently drop the restore, regressing
SiteIsolation.RestoreSessionFromAnotherWebView and the two
NavigateIframe*BackForwardAfterSessionRestoreToNewWebView tests reactivated
in 315817@main.
Bug 317044 (315779@main) introduced the http/wpt/site-isolation/ copy of
this cluster test with only the back-direction subtest, because the other
three subtests timed out across the shared BF list without this fix. Extend
that copy to all four subtests now that the dead-frame skip is in place;
the platform-specific mac-site-isolation expected.txt override is no longer
needed because the http/wpt/site-isolation copy pins both flags via its
webkit-test-runner header.
The extended 4-subtest test exposes a separate pre-existing Debug-only
assertion in HistoryItem::addChildItem when the BF tree happens to contain
duplicate-frameID children after multiple subtests' iframes have been torn
down. That root cause (BF tree retaining frameIDs of destroyed iframes) is
fixed at the source by bug 317814 (eng/basuke/si-implies-uiproc-bfwd —
clears frameID in ~WebFrameProxy via a recursive BF tree walk); until that
lands, skip the test on Debug. Release continues to exercise all four
subtests.
*
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal-expected.txt:
*
LayoutTests/http/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal.html:
* LayoutTests/platform/mac-wk2/TestExpectations:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::goToBackForwardItem):
(WebKit::WebPageProxy::dispatchPerFrameTraversals):
(WebKit::WebPageProxy::sendGoToBackForwardItemForFrame):
* Source/WebKit/UIProcess/WebPageProxy.h:
Canonical link: https://commits.webkit.org/315925@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
