Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 462479883713a6d2f105fcb94b3dffb646dca926
https://github.com/WebKit/WebKit/commit/462479883713a6d2f105fcb94b3dffb646dca926
Author: Per Arne Vollan <[email protected]>
Date: 2026-08-14 (Fri, 14 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Source/WebKit/UIProcess/WebBackForwardList.swift
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
Cross-site iframe back/forward navigation is silently dropped after a
persisted session restore
https://bugs.webkit.org/show_bug.cgi?id=321303
rdar://184343275
Reviewed by Sihui Liu.
Persisted session restore, e.g. after an app relaunch, never serializes a child
frame's
FrameIdentifier -- it's process-local and can't survive a relaunch -- while
WebBackForwardList::findFrameStateInItem and
WebPageProxy::dispatchPerFrameTraversals
both assumed a child frame's stored FrameState would carry one. With it unset,
two separate
lookups broke silently:
- findFrameStateInItem's name/position fallback (used once the direct ID match
fails, which
is exactly what happens after a persisted restore) found the right FrameState
but left its
identifier unset, so the process WebPage::goToBackForwardItem swapped into
afterward
couldn't resolve it to any live or provisional frame and dropped the
navigation ("No target
local frame found ... navigation silently dropped").
- dispatchPerFrameTraversals's per-child pairing loop skipped a child outright
whenever its
stored FrameState had no identifier, instead of falling back to position the
way it already
does when the identifier is merely stale, so no GoToBackForwardItem message
was ever
dispatched for the frame at all ("walk dispatched no GoToBackForwardItem
messages ... will
be silently dropped").
Fixed by stamping the live frame's identifier onto the
FrameState/WebBackForwardListFrameItem
matched via either fallback, so downstream identifier-based lookups
(WebProcess::webFrame,
WebFrameProxy::webFrame, processForTheFrameItem) can find the right frame and
process.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::findFrameStateInItem):
* Source/WebKit/UIProcess/WebBackForwardList.swift:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::dispatchPerFrameTraversals):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::TEST(SiteIsolation,
GoBackToCrossSiteIframeAfterPersistedSessionRestore)):
Canonical link: https://commits.webkit.org/319165@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
