312527 2026-04-16 17:05:01 -0700 [Site Isolation] Route popup menu value-changed IPC to the originating frame 2026-05-18 17:59:15 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 zakr zakr webkit-bug-importer oldest_to_newest 2201299 0 zakr 2026-04-16 17:05:01 -0700 When a <select> popup menu is open, focus can move to a remote frame during the popup's nested run loop. WebPageProxy::Internals::valueChangedForPopupMenu() previously called focusedOrMainFrame() to find the destination process for the DidChangeSelectedIndexForActivePopupMenu IPC. With site isolation, that may resolve to a different process than the one that hosts the <select>, so the selection change is delivered to the wrong process. The originating WebProcess never receives the close signal, leaving its m_popupIsVisible state stuck and making the <select> appear broken, the next click is interpreted as a dismiss rather than an open, and the chosen option never reaches the DOM. Capture the originating frame's identifier in m_activePopupMenuFrameID at showPopupMenu() time and use it to route both DidChangeSelectedIndexForActivePopupMenu and (on non-Cocoa platforms) SetTextForActivePopupMenu. Clear the identifier in hidePopupMenu() and resetState(). 2201300 1 zakr 2026-04-16 17:05:21 -0700 <rdar://174886701> 2201301 2 zakr 2026-04-16 17:08:55 -0700 Pull request: https://github.com/WebKit/WebKit/pull/62939 2211884 3 ews-feeder 2026-05-18 17:59:13 -0700 Committed 313449@main (0a6b5cd60b4f): <https://commits.webkit.org/313449@main> Reviewed commits have been landed. Closing PR #62939 and removing active labels.