Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3e31762de6b1e418d94bfc40abd088466c7d5c28
https://github.com/WebKit/WebKit/commit/3e31762de6b1e418d94bfc40abd088466c7d5c28
Author: Anthony Tarbinian <[email protected]>
Date: 2026-08-06 (Thu, 06 Aug 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation-expected.html
A
LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation.html
A
LayoutTests/http/tests/site-isolation/resources/red-frame-navigating-to-x-frame-options-deny.html
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm
Log Message:
-----------
[Site Isolation] Stale iframe layers are left hosted after a cross-process
navigation
https://bugs.webkit.org/show_bug.cgi?id=321009
rdar://123701232
Reviewed by Sihui Liu.
With site isolation, the UIProcess is responsible for managing rendering layers
which comes
from frames in different processes. A web process will send the content that
should be
rendered in its iframe. Then, it's the UIProcess's job to put the rendered
content in the
right place on the screen.
On a process swap of an iframe, the UIProcess needs to receive the new content
from the new
web process and replace the iframe's old content.
The bug is that the UIProcess only appends the iframe's new content without
detaching the
iframe's old content.
This bug became visible when an iframe load is blocked by X-Frame-Options and
DocumentLoader::loadErrorDocument()
commits an empty, transparent document. Then, the iframe's previous document
is still visible while appearing unresponsive since the old web process isn't
repainting
the stale layer anymore. Usually new content is opaque, which is why I suspect
this wasn't
noticed before.
This patch updates RemoteLayerTreeHost::updateLayerTree to detach any existing
layer before
placing the new layer.
The regression test page is blue with a 200x200 iframe. The iframe loads a
cross-site red page from localhost, and that page then navigates itself to a URL
on web-platform.test that responds with X-Frame-Options: deny.
A blank frame is transparent, so the whole page should end up blue. The
reference file is
the same page with an <iframe src="about:blank"> instead of the real one.
Without the fix
the iframe is stuck as red.
Test: http/tests/site-isolation/draw-after-blocked-cross-origin-navigation.html
*
LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation-expected.html:
Added.
*
LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/red-frame-navigating-to-x-frame-options-deny.html:
Added.
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:
(WebKit::RemoteLayerTreeHost::updateLayerTree):
Canonical link: https://commits.webkit.org/318768@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
