Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f079bfc262594de4bbabad95f2478951a95dd07f
      
https://github.com/WebKit/WebKit/commit/f079bfc262594de4bbabad95f2478951a95dd07f
  Author: Darryl Parkinson <[email protected]>
  Date:   2026-07-30 (Thu, 30 Jul 2026)

  Changed paths:
    M Source/WebKit/UIProcess/Inspector/WebPageInspectorController.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm

  Log Message:
  -----------
  [Site Isolation] Web Inspector: UI process crash in didCommitProvisionalFrame 
when a provisional subframe commits after a main-frame swap
https://bugs.webkit.org/show_bug.cgi?id=320557
rdar://180217073

Reviewed by Qianlang Chen.

didCommitProvisionalPage() removes every frame target belonging to the page. A 
subframe that still
had a pending ProvisionalFrameProxy can commit after that, because the 
suspended page keeps both the
subframe and the RemotePageProxy that routes its
DidCommitLoadForFrame, so didCommitProvisionalFrame()
finds no target for the frame and dereferences a null CheckedPtr.

Guard the target notifications on the target still being present, while still 
running the
instrumentation migration that follows so per-process registrations stay 
paired. Also skip taking the
old target when both identifiers match, which happens when a frame commits into 
the process it was
already provisional in and would otherwise destroy the target just committed

Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm

* Source/WebKit/UIProcess/Inspector/WebPageInspectorController.cpp:
(WebKit::WebPageInspectorController::didCommitProvisionalFrame):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::(SiteIsolation, 
ProvisionalSubframeCommitAfterMainFrameSwapDoesNotCrash)):

Canonical link:
https://flagged.apple.com:443/proxy?t2=Do9l2T0hw4&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE4MjM5QG1haW4=&emid=861aa543-7e5d-4c02-b973-d26ad4579024&c=11



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to