Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8de66dfab583dd94beceb39726595d4fa890b337
https://github.com/WebKit/WebKit/commit/8de66dfab583dd94beceb39726595d4fa890b337
Author: Ryosuke Niwa <[email protected]>
Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths:
M LayoutTests/http/tests/ipc/createnewpage-file-body-sandbox-extension.html
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/loader/DocumentLoader.h
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/NavigationAction.cpp
M Source/WebCore/loader/NavigationAction.h
M Source/WebKit/Shared/LoadParameters.h
M Source/WebKit/Shared/LoadParameters.serialization.in
M Source/WebKit/Shared/NavigationActionData.h
M Source/WebKit/Shared/NavigationActionData.serialization.in
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/UIProcess/API/APINavigation.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
Log Message:
-----------
[Site Isolation]
imported/w3c/web-platform-tests/html/browsers/browsing-the-web/history-traversal/pageswap/pageswap-replace-with-cross-origin-redirect.sub.html
fails
https://bugs.webkit.org/show_bug.cgi?id=324737
Reviewed by Basuke Suzuki.
A location.replace() whose final URL is same-origin but which passes through a
cross-site
redirect is handed to another process mid-flight under site isolation. The
resolved history
handling didn't travel with it, so the process that finally committed the
document resolved
the navigation as a push instead of a replace.
Navigation::initializeForNewWindow then took the push branch, which falls
through to
setActivation(history().previousItem(), ...). A
RedirectWithLockedBackForwardList load updates
the current history item in place rather than calling setCurrentItem, so
m_previousItem is
never set and there is no entry to populate navigation.activation.from with.
The sibling push
test passes because a standard load does call setCurrentItem.
Carry the history handling along with the navigation.
NavigationAction::navigationHistoryBehavior()
recovers it from the resolved navigation API type, and it rides in
NavigationActionData ->
API::Navigation -> LoadParameters -> the FrameLoadRequest in
WebPage::loadRequest.
That request reaches FrameLoader::load(FrameLoadRequest&&) ->
loadWithDocumentLoader, which
bypasses loadURL, the only function that consulted navigationHistoryBehavior().
It hardcoded
NavigationHistoryBehavior::Auto everywhere it computed the navigation API type,
so a
RedirectWithLockedBackForwardList load always resolved to push. Store the
behavior on the
DocumentLoader and use it there instead. Loaders created on every other path
keep the Auto
default, so nothing else changes behavior.
* LayoutTests/platform/ios-site-isolation/TestExpectations: Remove passing test
expectation.
* LayoutTests/platform/mac-site-isolation/TestExpectations: Remove passing test
expectation.
* Source/WebCore/loader/DocumentLoader.h:
(WebCore::DocumentLoader::navigationHistoryBehavior const):
(WebCore::DocumentLoader::setNavigationHistoryBehavior):
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::load):
(WebCore::FrameLoader::loadWithDocumentLoader):
* Source/WebCore/loader/NavigationAction.cpp:
(WebCore::NavigationAction::navigationHistoryBehavior const):
* Source/WebCore/loader/NavigationAction.h:
* Source/WebKit/Shared/LoadParameters.h:
* Source/WebKit/Shared/LoadParameters.serialization.in:
* Source/WebKit/Shared/NavigationActionData.h:
* Source/WebKit/Shared/NavigationActionData.serialization.in:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/UIProcess/API/APINavigation.h:
(API::Navigation::navigationHistoryBehavior const):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::loadRequestWithNavigationShared):
(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):
(WebKit::WebPageProxy::continueNavigationInNewProcess):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::createWindow):
* Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::navigationActionData const):
* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadRequest):
Canonical link: https://commits.webkit.org/321605@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
