Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6a158c26f43225035d5999c7f758c164534308e8
https://github.com/WebKit/WebKit/commit/6a158c26f43225035d5999c7f758c164534308e8
Author: Sean Patterson <[email protected]>
Date: 2026-04-03 (Fri, 03 Apr 2026)
Changed paths:
M Source/WebCore/page/FocusController.cpp
M Tools/TestWebKitAPI/Tests/WebKitCocoa/FocusWebView.mm
Log Message:
-----------
[Site Isolation] Fix null dereference crash when focus navigates into
cross-origin iframe containing
a nested remote frame rdar://172564611
https://bugs.webkit.org/show_bug.cgi?id=310307
Reviewed by Megan Gardner.
When findFocusableElementAcrossFocusScope found a candidate with
ContinuedSearchInRemoteFrame::Yes,
it did not return early, allowing execution to continue into the Remote frame
owner case with a null
currentNode, causing a crash. Also adds null checks for currentNode and
currentFrame in the Remote
frame handling path.
* Source/WebCore/page/FocusController.cpp:
(WebCore::FocusController::findFocusableElementAcrossFocusScope): Scope the
Remote case with case
Frame::FrameType::Remote: { } to satisfy C++ jump-past-initialization rules.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/FocusWebView.mm:
(FocusWebView.FocusNavigationIntoFrameWithNestedRemoteFrame): Regression test
with site isolation
disabled. Tab key navigation descends into the nested frame tree, focusing
innerInput then
outerInput.
(FocusWebView.FocusNavigationIntoFrameWithNestedRemoteFrameSiteIsolation): Same
test with site
isolation enabled. With site isolation, innerFrame (apple.com) is a RemoteFrame
from webkit.org's
perspective. isFocusScopeOwner returns false for remote-frame iframes, so focus
traversal skips it
and lands directly on the first locally-reachable element (outerInput) in
webkit.org's process.
Only one Tab is needed: mainInput → outerInput.
Canonical link: https://commits.webkit.org/310547@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
