Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 713192fabebfdd2955aa596c262c33bfbf3d50be
https://github.com/WebKit/WebKit/commit/713192fabebfdd2955aa596c262c33bfbf3d50be
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
M Source/WebKit/UIProcess/ProvisionalPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
Log Message:
-----------
[Site Isolation] http/tests/local/blob/navigate-blob.html fails
https://bugs.webkit.org/show_bug.cgi?id=322503
Reviewed by Alex Christensen.
When a process commits a new top document, Page::setMainFrameURLAndOrigin()
broadcasts that document's complete DocumentSyncData so the other processes
hosting frames of the page can answer questions about the top document --
Page::mainFrameOrigin(), Page::mainFrameURL() and the rest -- without being able
to see it.
For a main frame navigation that swaps processes, that broadcast can reach the
UI
process before commitProvisionalPage() has pointed legacyMainFrameProcess() at
the
committing process. WebPageProxy::broadcastAllDocumentSyncData() then rejects
it as
coming from a process that does not host the top document. Nothing re-sends it,
so
the update is lost for good and every other process hosting a frame of that page
goes on reporting the previous top document's state.
ProvisionalPageProxy::didReceiveMessage() already forwards both sync data
broadcasts to the WebPageProxy, so these messages are meant to be handled while
a
load is provisional; only the guard failed to account for it. Rather than
dropping
a broadcast from the current provisional page, hold it on the
ProvisionalPageProxy
-- next to the existing m_deferredRemoteTransitionSite, which defers commit-time
work the same way -- and apply it in commitProvisionalPage() once
swapToProvisionalPage() has switched legacyMainFrameProcess(). The guard itself
is
unchanged, so an unrelated subframe process still cannot touch top document
state,
and data belonging to a provisional load that never commits is discarded with
the
ProvisionalPageProxy.
Single-property broadcasts are folded in only when that process has already
sent a
full payload. Applying one over a default constructed DocumentSyncData would
present every other field as though the new document had reset it, which is
worse
than dropping it.
A process that had no page for this browsing context group before the navigation
picks the state up from its remote page creation parameters instead, and the
process that hosted the previous main frame gets it from
LoadDidCommitInAnotherProcess(), which is why this needs a window navigated
across
origins more than once to show up.
Blob URLs made this visible. They are partitioned by the top document's origin:
BlobURLRegistry::registerURL() and WebLoaderStrategy::scheduleLoad() both key
off
Document::topOrigin(), which for a subframe resolves to Page::mainFrameOrigin(),
and BlobRegistryImpl::blobDataFromURL() rejects a lookup whose top origin does
not
match the one recorded at registration. With a stale top origin a subframe is
both
denied a blob URL belonging to its own partition and able to reach one
partitioned
under the previous top origin, which is what the partitioning exists to prevent.
Covered by http/tests/local/blob/navigate-blob.html under site isolation, whose
last step reads a blob from the partition it was created in after the window has
been navigated localhost:8443 -> localhost:8000 -> 127.0.0.1:8000.
* LayoutTests/platform/ios-site-isolation/TestExpectations:
* LayoutTests/platform/mac-site-isolation/TestExpectations:
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::setDeferredTopDocumentSyncData):
(WebKit::ProvisionalPageProxy::updateDeferredTopDocumentSyncData):
(WebKit::ProvisionalPageProxy::takeDeferredTopDocumentSyncData):
* Source/WebKit/UIProcess/ProvisionalPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::commitProvisionalPage):
(WebKit::WebPageProxy::broadcastDocumentSyncData):
(WebKit::WebPageProxy::broadcastAllDocumentSyncData):
(WebKit::WebPageProxy::applyDeferredTopDocumentSyncDataFromCommittedProcess):
* Source/WebKit/UIProcess/WebPageProxy.h:
Canonical link: https://commits.webkit.org/319882@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
