Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fc5ea9bf36dbf8572e118e5dd572aff39b8f5c74
https://github.com/WebKit/WebKit/commit/fc5ea9bf36dbf8572e118e5dd572aff39b8f5c74
Author: Ryosuke Niwa <[email protected]>
Date: 2026-10-05 (Mon, 05 Oct 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Site Isolation] Crash in WebPageProxy::continueNavigationInNewProcess when
the page closes while a navigate event is pending
https://bugs.webkit.org/show_bug.cgi?id=326430
Reviewed by Chris Dumez.
When a process-swapping navigation has a pending navigate event,
receivedNavigationActionPolicyDecision
waits for the reply to DispatchPendingNavigateEventForProcessSwap before calling
continueNavigationInNewProcess. The reply handler only checked that the
WebPageProxy was still alive.
If the page was closed while it waited, resetState() had cleared m_mainFrame,
and
continueNavigationInNewProcess crashed dereferencing mainFrame() to construct a
Site.
Re-run the checks done before the wait (page closed, navigation gone, main
frame replaced) in the reply
handler, plus a null check on m_mainFrame, and treat a failure as a cancelled
navigation.
Test:
TestWebKitAPI.SiteIsolation.CloseWhileDispatchingNavigateEventBeforeProcessSwap
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::TEST(SiteIsolation,
CloseWhileDispatchingNavigateEventBeforeProcessSwap)):
Canonical link: https://commits.webkit.org/322816@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
