Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 75ca791670dfc265fb40c9e87666224a8b4bc785
https://github.com/WebKit/WebKit/commit/75ca791670dfc265fb40c9e87666224a8b4bc785
Author: Basuke Suzuki <[email protected]>
Date: 2026-07-08 (Wed, 08 Jul 2026)
Changed paths:
A LayoutTests/http/wpt/navigation-api/resources/traverse-subframe-child.html
A
LayoutTests/http/wpt/navigation-api/traverse-subframe-remote-sibling.sub-expected.txt
A
LayoutTests/http/wpt/navigation-api/traverse-subframe-remote-sibling.sub.html
M Source/WebCore/loader/HistoryController.cpp
Log Message:
-----------
[Navigation API] Subframe back/forward traversal abandons local sibling
frames after a RemoteFrame under Site Isolation
https://bugs.webkit.org/show_bug.cgi?id=318483
rdar://181274065
Reviewed by Rupin Mittal.
Under Site Isolation a cross-origin subframe is a RemoteFrame that lives in
another WebProcess.
HistoryController::recursiveGatherFramesToNavigate iterates the target
HistoryItem's children in
tree order to collect the frames a back/forward traversal must navigate. For
each child it looks
up the corresponding frame and, when the frame is not a LocalFrame, it did a
bare `return` that
abandoned the entire remaining sibling loop -- not just the remote child. So
any local sibling
ordered after a RemoteFrame child was never appended to framesToNavigate and
never received
loadItem(): it silently failed to traverse, and a Navigation API
traverseTo()/back()/forward()
targeting that frame left its committed/finished promise unsettled.
The two sibling walkers (recursiveSetProvisionalItem, recursiveGoToItem)
already use skip
semantics -- `if (RefPtr childFrame = dynamicDowncast<LocalFrame>(...))` -- and
simply move on to
the next sibling. Match them: skip the RemoteFrame child (its traversal is
driven in its own
process) and continue gathering the remaining local siblings.
*
LayoutTests/http/wpt/navigation-api/traverse-subframe-remote-sibling.sub.html:
Added. A
Site-Isolation-pinned test with a cross-origin RemoteFrame sibling ordered
before a same-origin
LocalFrame; a joint traversal must still move the local frame. Fails today
(committed never
settles, index unchanged); passes with the fix.
*
LayoutTests/http/wpt/navigation-api/traverse-subframe-remote-sibling.sub-expected.txt:
Added.
* LayoutTests/http/wpt/navigation-api/resources/traverse-subframe-child.html:
Added.
* Source/WebCore/loader/HistoryController.cpp:
(WebCore::HistoryController::recursiveGatherFramesToNavigate): Skip (continue)
a non-LocalFrame
child instead of returning from the whole loop, so local sibling frames ordered
after a
RemoteFrame are still gathered for traversal.
Canonical link: https://commits.webkit.org/316726@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
