Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b1a790aab65acaee0e7395b20fe98bff3d539ada
https://github.com/WebKit/WebKit/commit/b1a790aab65acaee0e7395b20fe98bff3d539ada
Author: Ryosuke Niwa <[email protected]>
Date: 2026-07-18 (Sat, 18 Jul 2026)
Changed paths:
M Source/WebKit/UIProcess/BrowsingContextGroup.cpp
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Site Isolation] FrameProcess which is still in use can be put into process
cache with shared process
https://bugs.webkit.org/show_bug.cgi?id=319649
rdar://182138793
Reviewed by Ben Nham and Megan Gardner.
canTerminateAuxiliaryProcess() gated caching/termination on pages, remote
pages, suspended pages, and
provisional pages - but not on m_frameProcessCount. When a page with a
cross-site subframe enters the
back/forward cache, the subframe's WebFrameProxy (and thus its
Ref<FrameProcess> on the shared process)
is preserved for restoration, but the shared process's RemotePageProxy is
removed. That empties
m_remotePages, so maybeShutDown() sees the process as idle and adds it to the
WebProcess cache - even
though m_sharedProcess's FrameProcess is still alive. The next subframe
navigation then finds
m_sharedProcess valid but it's in the process cache, hitting the condition
worked around in 314821@main.
Fixed the bug by treating m_frameProcessCount > 0 as in-use in
canTerminateAuxiliaryProcess so that
a process still backing live FrameProcess objects (e.g. BFCache-preserved
subframes) is never cached or
terminated. decrementFrameProcessCount() now calls maybeShutDown() when the
count reaches zero, mirroring
removeRemotePageProxy/removeSuspendedPageProxy. Without this, gating on the
count would leak processes\
(nothing else re-evaluates shutdown when the last frame goes away).
Test: TestWebKitAPI.SiteIsolation.SharedProcessInProcessCacheAfterNavigation
* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:
(WebKit::BrowsingContextGroup::sharedProcessForSite):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::decrementFrameProcessCount):
(WebKit::WebProcessProxy::canTerminateAuxiliaryProcess):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::siteIsolatedViewWithSharedProcess):
(TestWebKitAPI::(SiteIsolation, SharedProcessInProcessCacheAfterNavigation)):
Canonical link: https://commits.webkit.org/317506@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
