Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c9a43027bc80a144b86a267e616ed6bcacbd6e6a
https://github.com/WebKit/WebKit/commit/c9a43027bc80a144b86a267e616ed6bcacbd6e6a
Author: Sihui Liu <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
M LayoutTests/fast/loader/site-isolation/form-state-restore-with-frames.html
M Source/WebKit/UIProcess/API/APINavigation.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebProcessPool.cpp
Log Message:
-----------
[Site Isolation] UI process driven back/forward navigation fails to restore a
page from in-process back/forward cache
https://bugs.webkit.org/show_bug.cgi?id=327305
rdar://189848378
Reviewed by Basuke Suzuki.
When UseUIProcessForBackForwardItemLoading is enabled under Site Isolation,
WebPageProxy::goToBackForwardItem() takes
the target item's in-process WebBackForwardCacheEntry for restoration and
removes it from the item before sending
GoToBackForwardItem to the web process. The web process finds the cached page,
but asks the UI process for a policy
decision before restoring it. WebProcessPool::processForNavigation() relies on
the item's entry to keep the navigation
in the process holding the cached page; since the entry is already gone, it
falls back to regular process selection,
which may pick a new process. The cached page is then lost and the page is
reloaded instead.
This happens when the current page and the cached page are cross-site but in
the same process. For example, a file:
page navigates to a data: URL; the data: URL has an empty site, so it stays in
the file: page's process, and going back
from it to the file: page is a cross-site navigation. When the web process
drives the traversal itself,
goToBackForwardItem() is not involved, so the entry stays on the item until the
restored page commits and
processForNavigation() finds it.
To fix this, record the cached main frame's process on the API::Navigation
before removing the entry, and make
processForNavigation() use it when the target item no longer has an entry.
fast/loader/site-isolation/form-state-restore-with-frames.html covers this
case, but it ran with
UseUIProcessForBackForwardItemLoading disabled, since the flag is unstable and
gets reset between tests. Enable it
explicitly in the test. Without the fix, the test times out when
UseUIProcessForBackForwardItemLoading is enabled: each
back navigation reloads the page in a new process without the form state, so
the test keeps resubmitting the form.
* LayoutTests/fast/loader/site-isolation/form-state-restore-with-frames.html:
* Source/WebKit/UIProcess/API/APINavigation.h:
(API::Navigation::backForwardCacheMainFrameProcessIdentifier const):
(API::Navigation::setBackForwardCacheMainFrameProcessIdentifier):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::goToBackForwardItem):
* Source/WebKit/UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::processForNavigation):
Canonical link: https://commits.webkit.org/323667@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
