Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 20cb0ee48f9726d64fddd00a3a2c753394872f76
https://github.com/WebKit/WebKit/commit/20cb0ee48f9726d64fddd00a3a2c753394872f76
Author: Basuke Suzuki <[email protected]>
Date: 2026-10-02 (Fri, 02 Oct 2026)
Changed paths:
M
LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash-expected.txt
M
LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash.html
A
LayoutTests/http/tests/navigation-api/navigate-denied-by-policy-fires-navigateerror-expected.txt
A
LayoutTests/http/tests/navigation-api/navigate-denied-by-policy-fires-navigateerror.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-no-site-isolation.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-no-site-isolation.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-subframe.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-subframe.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-no-site-isolation.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-no-site-isolation.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-subframe.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-subframe.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-no-site-isolation.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-no-site-isolation.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-subframe.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-subframe.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate.sub-expected.txt
A
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate.sub.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/resources/count-requests.py
A
LayoutTests/http/wpt/site-isolation/navigation-api/resources/navigate-and-report.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/resources/navigate-while-loading.html
M
LayoutTests/http/wpt/site-isolation/navigation-api/resources/preventdefault-canceller.html
A
LayoutTests/http/wpt/site-isolation/navigation-api/resources/record-event.py
A
LayoutTests/http/wpt/site-isolation/navigation-api/resources/report-recorded-events.html
M
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/defer/tentative/defer-cross-origin-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/defer/tentative/defer-with-multiple-handlers-and-single-reject-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-no-beforeunload-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-no-beforeunload.html
A
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-stops-ongoing-cross-document-navigation-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-stops-ongoing-cross-document-navigation.html
A
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-navigation-navigate-cross-site-preventDefault-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-navigation-navigate-cross-site-preventDefault.html
A
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/resources/navigate-cross-site-preventDefault-helper.html
M Source/WebCore/Headers.cmake
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/FrameLoader.h
M Source/WebCore/loader/NavigationAction.h
M Source/WebCore/page/NavigateEvent.h
M Source/WebCore/page/NavigateEventDispatchResult.h
A Source/WebCore/page/NavigateEventIdentifier.h
M Source/WebCore/page/Navigation.cpp
M Source/WebCore/page/Navigation.h
Log Message:
-----------
[Navigation API] preventDefault() does not cancel a cross-site
navigation.navigate() that swaps processes
https://bugs.webkit.org/show_bug.cgi?id=325553
rdar://188636761
Reviewed by Alex Christensen.
navigation.navigate() used a synchronous navigation policy check (288106@main),
whose reply falls
back to Use before the UI process decides on a process swap. The source process
then loaded the
destination as well as the process the UI process chose, so preventDefault()
could not cancel it,
and under Site Isolation the source process was killed or committed a
cross-site document in the
embedder's process (rdar://188750371).
Cross-document navigation.navigate() now uses the asynchronous policy check
like other
cross-document navigations.
FrameLoader::shouldCheckNavigationPolicyAfterDispatchingEvents()
first fires the events navigate() needs, the navigate event and then
beforeunload, which is the
order the HTML spec uses for push, replace and reload navigations, and then
tells whether the
navigation should still go on to the policy check. A navigate() whose navigate
event is
intercepted therefore no longer fires beforeunload. The events run after the
load being replaced
is stopped and after scheduled navigations are cancelled, as they did when they
ran after the
synchronous policy decision.
Since these events already ran, the rest of the navigation treats them as done:
- continueLoadAfterNavigationPolicy() does not dispatch beforeunload again.
- If the policy check denies the navigation, the navigate event is aborted
(navigateerror and
AbortError). The abort is queued and only applies while that event is still
the ongoing one,
because a newer navigation cancels this policy check as it starts and aborts
the event itself.
To recognize it, every NavigateEvent now has a NavigateEventIdentifier, which
NavigateEventDispatchResult carries back to the navigation that fired it.
- LoadWillContinueInAnotherProcess does not abort it, since the navigation
carries on elsewhere.
When the other process commits the navigation, the old frame or page is torn
down through
FrameLoader::detachFromParent(). Its closeURL() unloads the document without
aborting the
Navigation API, but the stopAllLoaders() that followed aborted the ongoing
navigation whenever
the document was still loading, so the document got navigateerror for a
navigation that had
committed. navigate() now leaves that navigation ongoing until then, which made
this reachable.
detachFromParent() no longer aborts after unloading; removing an iframe still
aborts, through
FrameLoader::frameDetached(), as the spec requires for a destroyed child
navigable.
The asynchronous check also lets a client that decides late deny navigate();
before, its answer
arrived after the synchronous fallback had already allowed the load.
Two tentative deferPageSwap tests call navigate() while their popup is still
parsing. The load
used to start inside that script and stop the parser, so pagehide never fired
and they timed out.
They now reach their assertions: one passes and the other fails because WebKit
does not
implement deferPageSwap.
fast/canvas/offscreen-webgl-transfer-after-navigation-crash.html relied on
navigation.navigate("about:blank") committing before its next line ran, which
tore down the
document and lost the WebGL context. It now navigates an iframe that owns the
canvas and calls
transferToImageBitmap() once the iframe has loaded; without the fix from
309187@main it still
crashes.
*
LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash-expected.txt:
* LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash.html:
*
LayoutTests/http/tests/navigation-api/navigate-denied-by-policy-fires-navigateerror-expected.txt:
Added.
*
LayoutTests/http/tests/navigation-api/navigate-denied-by-policy-fires-navigateerror.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-no-site-isolation.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-no-site-isolation.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-subframe.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once-subframe.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-loads-once.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-no-site-isolation.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-no-site-isolation.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-subframe.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror-subframe.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/navigate-cross-site-swap-while-loading-no-navigateerror.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-no-site-isolation.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-no-site-isolation.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-subframe.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate-subframe.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate.sub-expected.txt:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/preventdefault-cancels-cross-site-swap-navigate.sub.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/resources/count-requests.py:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/resources/navigate-and-report.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/resources/navigate-while-loading.html:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/resources/preventdefault-canceller.html:
* LayoutTests/http/wpt/site-isolation/navigation-api/resources/record-event.py:
Added.
*
LayoutTests/http/wpt/site-isolation/navigation-api/resources/report-recorded-events.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/defer/tentative/defer-cross-origin-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/defer/tentative/defer-with-multiple-handlers-and-single-reject-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-no-beforeunload-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-no-beforeunload.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-stops-ongoing-cross-document-navigation-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-stops-ongoing-cross-document-navigation.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-navigation-navigate-cross-site-preventDefault-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-navigation-navigate-cross-site-preventDefault.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/resources/navigate-cross-site-preventDefault-helper.html:
Added.
* Source/WebCore/Headers.cmake:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadWithDocumentLoader):
(WebCore::FrameLoader::shouldCheckNavigationPolicyAfterDispatchingEvents):
Added.
(WebCore::FrameLoader::detachFromParent):
(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
* Source/WebCore/loader/FrameLoader.h:
* Source/WebCore/loader/NavigationAction.h:
(WebCore::NavigationAction::dispatchedEventsBeforeNavigationPolicy const):
Added.
(WebCore::NavigationAction::navigateEventDispatchedBeforeNavigationPolicy
const): Added.
(WebCore::NavigationAction::setDispatchedEventsBeforeNavigationPolicy): Added.
* Source/WebCore/page/NavigateEvent.h:
(WebCore::NavigateEvent::identifier const): Added.
* Source/WebCore/page/NavigateEventDispatchResult.h:
(WebCore::NavigateEventDispatchResult::completed):
(WebCore::NavigateEventDispatchResult::aborted):
(WebCore::NavigateEventDispatchResult::intercepted):
(WebCore::NavigateEventDispatchResult::deferredCommit):
* Source/WebCore/page/NavigateEventIdentifier.h: Added.
* Source/WebCore/page/Navigation.cpp:
(WebCore::Navigation::innerDispatchNavigateEvent):
(WebCore::Navigation::abortOngoingNavigationIfStartedBy): Added.
* Source/WebCore/page/Navigation.h:
Canonical link: https://commits.webkit.org/322591@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
