Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 60a8b5a259e838abb0c91565b594acc37dff175b
https://github.com/WebKit/WebKit/commit/60a8b5a259e838abb0c91565b594acc37dff175b
Author: Basuke Suzuki <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
[Site Isolation] Per-frame back/forward walk dispatches a duplicate traversal
to one live frame, clobbering the iframe navigation
https://bugs.webkit.org/show_bug.cgi?id=318015
rdar://180813822
Reviewed by Sihui Liu.
Under UseUIProcessForBackForwardItemLoading,
WebPageProxy::dispatchPerFrameTraversals walks
the (from, to) back/forward frame trees and pairs each target child frame with
a source child
by frameID, falling back to position. When a back/forward entry's child frame
tree carries a
duplicated frameID — an unaffected sibling iframe that inherited the navigated
frame's
frameID — childItemForFrameID resolves two distinct target children to the same
source child.
The walk then dispatches a second per-frame GoToBackForwardItem to the same
live frame; the
second message (same navigationID) supersedes the first, so the intended iframe
navigation is
lost and the back/forward action hangs.
This surfaces as a flaky ~33s timeout in
SiteIsolation.NavigateFrameWithSiblingsBackForward on
api-mac / api-mac-debug: navigating one of two sibling iframes and then going
back/forward
intermittently records the unaffected sibling with the navigated frame's
frameID, so the
forward traversal dispatches GoToBackForwardItem twice to the same frame and
the expected
navigation never completes.
Fix: pair each source child with at most one target child. When the
frameID-resolved source
child is already paired, fall back to position to recover the correct sibling,
so a duplicated
frameID can no longer route two target frames to the same live frame.
The underlying capture-side bug (a sibling inheriting another frame's frameID
when the
back/forward frame tree is recorded) is a separate, deeper issue in the same
area as the
BF-tree frameID staleness work; this change is a defensive guard in the walk.
Covered by existing tests (SiteIsolation.NavigateFrameWithSiblingsBackForward,
previously
flaky; 50/50 iterations pass with this change).
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::dispatchPerFrameTraversals):
Canonical link: https://commits.webkit.org/316017@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
