Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 884d0116ea09545d3bebd0d91a834ecc23ab6c31
https://github.com/WebKit/WebKit/commit/884d0116ea09545d3bebd0d91a834ecc23ab6c31
Author: Sean Patterson <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Site Isolation] UI process crashes in
WebFrameProxy::broadcastFrameTreeSyncData when a remote web process terminates
while loading cross-site iframes in private browsing
https://bugs.webkit.org/show_bug.cgi?id=321633
rdar://184724123
Reviewed by Abrar Rahman Protyasha.
broadcastFrameTreeSyncData has a RELEASE_ASSERT that site isolation is enabled.
Four of its five callers check the preference first; the one in
remoteProcessDidTerminate does not. 7e7db43cb121 added the assert, the guarded
callsite in didCommitLoad, and this unguarded one, all in the same commit.
siteIsolationEnabled is a mutable preference, and nothing tears down a
RemotePageProxy or removes a page from its BrowsingContextGroup when it is
turned
off on a live page - WebPreferences::update() only calls
WebPageProxy::preferencesDidChange(). So a remote page created while site
isolation was enabled outlives the preference change, and when its process later
terminates, RemotePageProxy::processDidTerminate reaches
remoteProcessDidTerminate, which broadcasts unconditionally and the release
assert kills the UI process.
Check the preference at the callsite, the way didCommitLoad does.
The test kills the iframe process and waits for it to exit rather than waiting
on
-waitForWebContentProcessDidTerminate. An iframe process is not the page's
siteIsolatedProcess(), so WebProcessProxy::terminationReason() reports
NonMainFrameWebContentProcessCrash, and
NavigationState::NavigationClient::processDidTerminate returns early for that
reason
without invoking the delegate. Waiting on it never completes, so the test times
out
instead of failing.
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::remoteProcessDidTerminate):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::setFeatureEnabled):
(TestWebKitAPI::enableFeature):
Canonical link: https://commits.webkit.org/319406@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
