Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 22d9c3a6e99c50eeb774cc1583e9654788ca18a3
https://github.com/WebKit/WebKit/commit/22d9c3a6e99c50eeb774cc1583e9654788ca18a3
Author: Sean Patterson <[email protected]>
Date: 2026-07-28 (Tue, 28 Jul 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/FetchLocalFile.mm
Log Message:
-----------
Reloading a local file after a WebContent process crash can fail with
kCFURLErrorCannotOpenFile (-3001)
https://bugs.webkit.org/show_bug.cgi?id=319695
rdar://164578060
Reviewed by Per Arne Vollan.
Loading a top-level file:// resource requires a sandbox extension to be handed
down to the Networking
process, which performs the file read.
WebPageProxy::maybeInitializeSandboxExtensionHandle() cannot
issue that extension while the target WebContent process is still launching (it
has no audit token
yet), so it returns std::nullopt and the load is expected to be deferred until
the process finishes
launching, at which point the extension is re-issued
(WebProcessProxy::shouldSendPendingMessage).
loadFile(), loadRequestWithNavigationShared(), and ProvisionalPageProxy all
implement this deferral:
for a file:// URL on a launching process they send the *WaitingForProcessLaunch
variant of the load
message. WebPageProxy::launchProcessForReload() -- the path taken to reload the
current back/forward
item after the WebContent process is killed or crashes -- did not. It
relaunched the process and
immediately sent WebPage::GoToBackForwardItem with an empty sandbox extension
handle. For a file://
item the relaunched WebContent therefore had no file access, could not create a
sandbox extension for
the Networking process, and the main-resource read failed with EPERM --
surfaced to the client as
NSURLErrorDomain -3001 (kCFURLErrorCannotOpenFile) and an error page.
This is intermittent in the field because it requires the file load to coincide
with a WebContent
process launch/relaunch; it reproduces reliably by killing the WebContent
process and reloading a
local file (e.g. a Mail attachment or a file in ~/Downloads or ~/Documents).
Granting the browser
Full Disk Access masks it because TCC then bypasses the extension chain
entirely.
Fix launchProcessForReload() to defer the reload for a file:// item on a
still-launching process by
sending GoToBackForwardItemWaitingForProcessLaunch, matching the other load
paths, so the sandbox
extension is re-issued once the process has finished launching.
Also add release-level error logging along the file-load sandbox-extension path
-- when the
extension fails to be minted in the Networking process
(createSandboxExtensionHandlesIfNecessary)
or fails to reach the loader (startNetworkLoad) -- so this class of failure can
be diagnosed from
a field log without a debug build.
* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp:
(WebKit::NetworkResourceLoadParameters::createSandboxExtensionHandlesIfNecessary):
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::startNetworkLoad):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::launchProcessForReload):
* Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/FetchLocalFile.mm:
(TEST(WebKit, ReloadLocalFileAfterWebContentProcessTermination)):
Canonical link: https://commits.webkit.org/318090@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
