Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fa42178e7969b4f1bd94432f95a1b27340b0af8d
https://github.com/WebKit/WebKit/commit/fa42178e7969b4f1bd94432f95a1b27340b0af8d
Author: Richard Robinson <[email protected]>
Date: 2026-09-27 (Sun, 27 Sep 2026)
Changed paths:
M Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Source/WebKit/UIProcess/WebBackForwardList.h
M Source/WebKit/UIProcess/WebBackForwardList.swift
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/ios/ViewGestureControllerIOS.mm
M Tools/TestWebKitAPI/PlatformCocoa.cmake
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKBackForwardListTests.swift
Log Message:
-----------
Calls to several WebBackForwardList methods result in leaks
https://bugs.webkit.org/show_bug.cgi?id=325374
rdar://188443131
Reviewed by Adrian Taylor and Abrar Rahman Protyasha.
When a Swift method returns a foreign reference type, the generated C++ thunk
hands the
caller a raw pointer that it owns (SWIFT_RETURNS_RETAINED). The C++ callers of
the Swift
WebBackForwardList were written against the C++ implementation, which returns
either an
unowned raw pointer or a RefPtr, so none of them released that reference. Every
call to
currentItem(), backItem(), forwardItem(), itemAtDeltaFromCurrentIndex() or
itemForID()
leaked a reference to a WebBackForwardListItem, and every call to
findFrameStateInItem()
leaked a FrameState.
These methods now return a RefPtr, as
goBackItemSkippingItemsWithoutUserGesture() already
did. Swift callers use new private helpers that return the item directly.
completeFrameStateForNavigation() is only called from Swift, so it is now
private and no
longer exposed to C++.
The C++ implementation's currentItem(), itemForID() and findFrameStateInItem()
now also
return a RefPtr, so both implementations have the same signatures and call
sites no longer
need to compile against either a raw pointer or a RefPtr.
protect() rejects an rvalue RefPtr, so the calls that wrapped currentItem() in
it now pass
the result straight to their RefPtr&& parameters.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKBackForwardListTests.swift
* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:
(-[WKWebView _snapshotLayerContentsForBackForwardListItem:]):
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::itemForID):
(WebKit::WebBackForwardList::currentItem const):
(WebKit::WebBackForwardList::findFrameStateInItem):
(WebKit::WebBackForwardListWrapper::currentItem const):
* Source/WebKit/UIProcess/WebBackForwardList.h:
* Source/WebKit/UIProcess/WebBackForwardList.swift:
(Direction.itemForID(_:)):
(Direction.entryForID(_:)):
(Direction.currentItem):
(Direction.currentEntry):
(Direction.backItem):
(Direction.backEntry):
(Direction.forwardItem):
(Direction.forwardEntry):
(Direction.itemAtDeltaFromCurrentIndex(_:allowSkipping:)):
(Direction.entryAtDeltaFromCurrentIndex(_:allowSkipping:)):
(Direction.clear):
(Direction.addChildItem(_:frameState:)):
(Direction.completeFrameStateForNavigation(_:)):
(Direction.goToItemInternal(_:)):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::launchProcessForReload):
(WebKit::WebPageProxy::loadRequest):
(WebKit::WebPageProxy::loadFile):
(WebKit::WebPageProxy::loadSimulatedRequest):
(WebKit::WebPageProxy::reload):
(WebKit::WebPageProxy::goToBackForwardItem):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::currentResourceDirectoryURL const):
* Tools/TestWebKitAPI/PlatformCocoa.cmake:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKBackForwardListTests.swift:
Added.
(WKBackForwardListTests.webView):
(WKBackForwardListTests.itemAccessorsDoNotLeakReferences):
(WKBackForwardListTests.itemsAreDestroyedWithWebView):
Canonical link: https://commits.webkit.org/322015@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
