Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e7745af34ee13b9360e0ae6aba21b4adde30d1cc
https://github.com/WebKit/WebKit/commit/e7745af34ee13b9360e0ae6aba21b4adde30d1cc
Author: Rob Buis <[email protected]>
Date: 2026-04-28 (Tue, 28 Apr 2026)
Changed paths:
A LayoutTests/fast/loader/navigate-on-pageswap-crash-expected.txt
A LayoutTests/fast/loader/navigate-on-pageswap-crash.html
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/FrameLoader.h
M Source/WebCore/page/Navigation.cpp
Log Message:
-----------
[WebKit][Main+SU] [3473ae787b8859f0] ASAN_SEGV |
WebCore::DocumentLoader::urlForHistory;
WebCore::HistoryController::updateForStandardLoad;
WebCore::FrameLoader::transitionToCommitted
https://bugs.webkit.org/show_bug.cgi?id=303364
rdar://165387940
Reviewed by Chris Dumez.
The test shows a case where a reload that is transitioning to be committed
can be interupted by a naigation.navigate during pageswap dispatching, which
does a sync policy check and so can clear the provisional loader, causing
a crash when executing the commitProvisionalLoad code after the pageswap event
dispatch is done.
To fix this abort the navigate when this gets detected.
Test: fast/loader/navigate-on-pageswap-crash.html
* LayoutTests/fast/loader/navigate-on-pageswap-crash-expected.txt: Added.
* LayoutTests/fast/loader/navigate-on-pageswap-crash.html: Added.
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::commitProvisionalLoad):
* Source/WebCore/loader/FrameLoader.h:
* Source/WebCore/page/Navigation.cpp:
(WebCore::Navigation::navigate):
Originally-landed-as: [email protected] (7f4921b7e92c).
rdar://174957555
Canonical link: https://commits.webkit.org/312227@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
