Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: eb46d8c72c1f3ca11fe79ebeb31bf546bda2daba
https://github.com/WebKit/WebKit/commit/eb46d8c72c1f3ca11fe79ebeb31bf546bda2daba
Author: Per Arne Vollan <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
M Source/WebKit/Shared/WebBackForwardListFrameItem.cpp
M Source/WebKit/Shared/WebBackForwardListFrameItem.h
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Source/WebKit/UIProcess/WebBackForwardList.h
M Source/WebKit/UIProcess/WebBackForwardList.swift
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
Dynamically created cross-site iframe gets stuck on about:blank after a
back/forward reload
https://bugs.webkit.org/show_bug.cgi?id=320761
rdar://184248998
Reviewed by Sihui Liu.
When useUIProcessForBackForwardItemLoading is enabled, WebPageProxy::
frameStateForBackForwardChildFrame resolves a child frame's history
entry by frame identifier, falling back to matching by sibling
position when the identifier isn't found (e.g. after session restore
or cross-site child-frame recreation). This position-based fallback
didn't verify that the entry at that position actually corresponded
to the same frame: a frame created fresh by script during a back/
forward-classified reload (e.g. a third-party iframe inserted by an
inline <script> before the page's load event) could match, by pure
position, a stale entry left behind by an earlier, differently-named
iframe that occupied the same child slot. The new frame was then
misrouted into loading that stale entry's URL and got stuck instead
of loading its own.
This is fixed by checking the frame name before falling back to
position.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
(TestWebKitAPI::TEST(SiteIsolation, GoBackReloadsDynamicallyCreated-
CrossSiteIframe))
* Source/WebKit/Shared/WebBackForwardListFrameItem.cpp:
(WebKit::WebBackForwardListFrameItem::childItemForFrameName):
* Source/WebKit/Shared/WebBackForwardListFrameItem.h:
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::findFrameStateInItem):
* Source/WebKit/UIProcess/WebBackForwardList.h:
* Source/WebKit/UIProcess/WebBackForwardList.swift:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::frameStateForBackForwardChildFrame):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::TEST(SiteIsolation,
GoBackReloadsDynamicallyCreatedCrossSiteIframe)):
Canonical link: https://commits.webkit.org/318789@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
