Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c5006bd78735e777c3127591880f223cf77ff9f3
https://github.com/WebKit/WebKit/commit/c5006bd78735e777c3127591880f223cf77ff9f3
Author: Ben Nham <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation-1.mm
Log Message:
-----------
[Site Isolation] Transient activation associated with forced user gesture can
outlive its associated frame
https://bugs.webkit.org/show_bug.cgi?id=326692
rdar://problem/189425702
Reviewed by Brady Eidson.
We run client-evaluated JavaScript (e.g. -evaluateJavaScript:) with a forced
user gesture. This
grants transient activation to the frame, its ancestors, and same-origin
descendants. When Site
Isolation is enabled, some of those other frames may run in other processes, so
we notify the other
processes about this activation via WebPageProxy::didNotifyUserActivation.
Normally, when the gesture is destroyed in the originating frame, we also
remove the corresponding
activations via WebPageProxy::didRevokeForcedUserActivation (see 322935@main).
However, there are
some paths where we destroy or navigate the originating frame before sending
that message, which
causes the activations to leak in other processes.
To fix this, have the UIProcess track all outstanding forced user gesture
tokens in
didNotifyUserActivation. Then when we commit a new load, destroy a frame, or a
WebProcess is
terminated, revoke all associated forced user gesture tokens from other
processes in the page.
Tests:
SiteIsolation.TransientActivationFromForcedUserGestureIsRevokedWhenCrossOriginIframeIsRemoved
SiteIsolation.TransientActivationFromForcedUserGestureIsRevokedWhenCrossOriginIframeNavigatesToAnotherSite
SiteIsolation.TransientActivationFromForcedUserGestureIsRevokedWhenCrossOriginIframeProcessExits
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didDestroyFrame):
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::didNotifyUserActivation):
(WebKit::WebPageProxy::didRevokeForcedUserActivation):
(WebKit::WebPageProxy::revokeForcedUserActivationInOtherProcesses):
(WebKit::WebPageProxy::revokeOutstandingForcedUserActivationsForFrame):
(WebKit::WebPageProxy::revokeOutstandingForcedUserActivationsForProcess):
(WebKit::WebPageProxy::dispatchProcessDidTerminate):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation-1.mm:
(TestWebKitAPI::webViewWithPendingForcedUserGestureInCrossOriginIframe):
(TestWebKitAPI::TEST(SiteIsolation,
TransientActivationFromForcedUserGestureIsRevokedWhenCrossOriginIframeIsRemoved)):
(TestWebKitAPI::TEST(SiteIsolation,
TransientActivationFromForcedUserGestureIsRevokedWhenCrossOriginIframeNavigatesToAnotherSite)):
(TestWebKitAPI::TEST(SiteIsolation,
TransientActivationFromForcedUserGestureIsRevokedWhenCrossOriginIframeProcessExits)):
Canonical link: https://commits.webkit.org/323143@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
