Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9b6cd50736f52a240fae733a9f66f8dbeb37556a
https://github.com/WebKit/WebKit/commit/9b6cd50736f52a240fae733a9f66f8dbeb37556a
Author: Basuke Suzuki <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Site Isolation] A new document can share a BrowsingContextGroup with a
back/forward-cached page
https://bugs.webkit.org/show_bug.cgi?id=319002
rdar://181851905
Reviewed by Sihui Liu.
Under Site Isolation, a non-back/forward main-frame navigation to a different
site reused the
current WebPageProxy's BrowsingContextGroup. When the outgoing page was then
placed in the
back/forward cache, its group -- and its still-live iframe processes -- was
retained by the
SuspendedPageProxy, so the incoming, unrelated document ended up in that same
group and linked
the suspended page's iframe processes. That is a Site Isolation boundary
violation: two
unrelated top-level browsing contexts must not share a group or its processes.
Give such a navigation a fresh BrowsingContextGroup at selection time,
mirroring where the COOP
browsing-context-group switch already does. The new branch is gated on the
single-page case
(!hasMultiplePages()), which is exactly the condition under which the outgoing
page is
back/forward-cached and has no opener/openee that must stay reachable across
the navigation, so
opener reachability (LoadStringAfterOpen, NavigateOpenerWindowCrossSite) is
preserved.
Empty-site targets (about:blank, data:) and the non-Site-Isolation PSON path
are intentionally
left out of scope.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::browsingContextGroupForNavigation): Start a fresh
BrowsingContextGroup for
a single-page, site-changing, non-back/forward main-frame navigation under Site
Isolation.
(WebKit::WebPageProxy::swapToProvisionalPage): Point the comment at
browsingContextGroupForNavigation,
where the group is actually chosen.
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::SiteIsolation::NavigateToUnrelatedDomainDoesNotShareBCGWithSuspendedPage):
Added.
(TestWebKitAPI::SiteIsolation::DrawAfterNavigateToDomainAgain): Update the
post-navigation
expectation to a lone c.com tree; the previous expectation encoded the bug.
Canonical link: https://commits.webkit.org/317103@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
