← WebKit — 2026-W38
11ce3debf28778630d5dd1d6f21425df86b003f8 [Site Isolation] Safari crashes after navigating to Instagram through embedded post
severity medium
class LogicError
confidence 0.35
signal score 6.17
Source/WebKit/UIProcess
Primitive: suspending current page whose main frame is the provisional page's commit target during process swap
Triage note: suspendCurrentPageIfPossible() gains a ProvisionalPageProxy argument and bails when provisionalPage.mainFrame() == mainFrame. A process-swap state fix that avoids suspending the page being committed into; plausibly security-adjacent (suspended-page lifetime) but no concrete memory-safety bug shown in the diff.
Triage note: suspendCurrentPageIfPossible() gains a ProvisionalPageProxy argument and bails when provisionalPage.mainFrame() == mainFrame. A process-swap state fix that avoids suspending the page being committed into; plausibly security-adjacent (suspended-page lifetime) but no concrete memory-safety bug shown in the diff.
Structural signals: smartptr_member_added (+4.87), surgical (+1.3)
Commit message
[Site Isolation] Safari crashes after navigating to Instagram through embedded post
https://bugs.webkit.org/show_bug.cgi?id=323912
rdar://185925090
Reviewed by Sihui Liu.
This is caused by a failing message check in WebPageProxy::didSameDocumentNavigationForFrameViaJS,
because the URL sent from the WebContent process does not match the URL of the frame.
The URL sent from the WebContent is correct, but the URL in the frame returned by WebFrameProxy::url()
is returning about:blank. It was set to about:blank because ProvisionalPageProxy reused the main frame
(m_shouldReuseMainFrame) since the page was opened by DOM, and WebPageProxy::commitProvisionalPage
found the current page eligible for suspension. When the page is found eligible for suspension,
WebPageProxy::suspendCurrentPageIfPossible calls didSuspend on the main frame's FrameLoadState, which
resets the provisonal URL member in FrameLoadState. Later, in FrameLoadState::didCommitLoad(), the URL
is derived from the provisional URL, which is now empty, so the URL in FrameLoadState is set to
about:blank, triggering the failing message check.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::suspendCurrentPageIfPossible):
(WebKit::WebPageProxy::commitProvisionalPage):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::suspendedReusedMainFrameResponses):
(TestWebKitAPI::checkSameDocumentNavigationAfterSuspendingReusedMainFrame):
(TestWebKitAPI::TEST(SiteIsolation, ReplaceStateAfterSuspendingReusedMainFrame)):
(TestWebKitAPI::TEST(SiteIsolation, PushStateAfterSuspendingReusedMainFrame)):
Canonical link: https://commits.webkit.org/321195@main
Before / after
Loading diff…
On This Page