Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8cf00b546db13546cf8d873cde72e8ab44ad8375
https://github.com/WebKit/WebKit/commit/8cf00b546db13546cf8d873cde72e8ab44ad8375
Author: Alex Christensen <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Ignore more messages from a site isolated frame's old process after
committing navigation to new process
https://bugs.webkit.org/show_bug.cgi?id=323994
rdar://186044136
Reviewed by Charlie Wolfe.
This is similar to 316899@main.
After a load commits in a new process, we send LoadDidCommitInAnotherProcess to
the old process,
but before that is received the old process continues operating uninformedly,
and it can send any message.
Some messages need to be ignored because it's coming from an old process.
WebPageProxy::didSameDocumentNavigationForFrame manipulates
WebFrameProxy::m_frameLoadState.m_url,
which can cause a future call to
WebPageProxy::didSameDocumentNavigationForFrameViaJS to have messed up
state. Ignoring the first call from the wrong process should help fix this
issue.
I noticed WebPageProxy::didUpdateHistoryTitle had the same message check using
m_legacyMainFrameProcess
so I updated it too.
This fixes an IPC-timing-dependent edge case that can't be hit reliably with a
unit test.
Because of our fragment navigation limits, we can't even write a unit test that
tries until it hits it.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
(WebKit::WebPageProxy::didUpdateHistoryTitle):
Canonical link: https://commits.webkit.org/321086@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
