Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 32ebbb5d6ca3e7d952777b3a58cd100161bc2058
https://github.com/WebKit/WebKit/commit/32ebbb5d6ca3e7d952777b3a58cd100161bc2058
Author: Basuke Suzuki <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Source/WebKit/WebProcess/WebPage/WebPage.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[BFCache][Site Isolation] CachedPage::restore asserts !page.subframeCount()
during RestoreWithFrameItem when restoring a BFCached page with cross-site
iframes
https://bugs.webkit.org/show_bug.cgi?id=318179
rdar://180989960
Reviewed by Sihui Liu.
Under multi-process BFCache with Site Isolation, restoring a back/forward-cached
page that has cross-site iframes crashed the WebProcess in CachedPage::restore
with ASSERTION FAILED: !page.subframeCount(), followed by a scrolling-state
LayerRepresentation assert.
The crash is in the multi-process BFCache restore path
(WebPage::restoreWithFrameItem
-> CachedPage::restore), reached only in an iframe process where the live page's
main frame is a RemoteFrame. Unlike the main-frame commit path
(FrameLoader::commitProvisionalLoad -> detachChildren, and
WebPageProxy::commitProvisionalPage -> removeChildFrames), the iframe-process
restore path is a bare take() + restore() with no step to tear down the outgoing
page's child frames. The residual live subframes belong to the outgoing
navigation, so CachedPage::restore's no-subframes precondition is violated and
the
assertion fires.
Detach the live page's residual subframes in WebPage::restoreWithFrameItem
immediately before CachedPage::restore, mirroring FrameLoader::detachChildren()
for LocalFrame children and WebFrame::removeFromTree() for RemoteFrame children.
The teardown only runs in an iframe process, where the main frame is a
RemoteFrame
and every direct child belongs to the outgoing navigation, so detaching all
children is safe; an assertion documents that invariant.
The added test loads two same-site pages that each embed a cross-site iframe, so
the back/forward item has a BFCache entry but no SuspendedPageProxy and goBack
restores via goToBackForwardItem's cached-children path, dispatching
RestoreWithFrameItem directly to the iframe process while the outgoing page's
subframe is still attached. Without this change the assertion fired on every
run;
with it the iframe process survives the restore.
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::restoreWithFrameItem):
(WebKit::WebPage::detachResidualSubframesForBackForwardCacheRestore):
* Source/WebKit/WebProcess/WebPage/WebPage.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TEST): Added MultiProcessBFCacheRestoreWithCrossSiteIframeDoesNotCrash.
Canonical link: https://commits.webkit.org/316243@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
