314583 2026-05-11 14:41:36 -0700 [BFCache] CachedPage::restore() leaks cached frame state when focus restoration is skipped 2026-05-11 17:45:15 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 basuke basuke webkit-bug-importer oldest_to_newest 2209852 0 basuke 2026-05-11 14:41:36 -0700 CachedPage::restore() has an early-return at `if (!focusedOrMainFrame) return;` that bypasses the `clear()` call at the end of the function. The cached frame state (m_cachedMainFrame holding CachedFrames with documents/views) is never released, even though the cached page's data has already been transferred to the live page by `m_cachedMainFrame->open()`. This causes ~CachedPage to call `m_cachedMainFrame->destroy()` later. After the fix in bug 314238 (which destroys child CachedFrames before checking m_document), destroy() now descends into child CachedFrames whose documents have already been resumed by open() (state = NotInBackForwardCache). The ASSERT at CachedFrame.cpp:291 ASSERT(document->backForwardCacheState() == Document::InBackForwardCache); then fires, and the subsequent destroy code path corrupts live document state (detachViewsAndDocumentLoader, detachFromPage, removeAllEventListeners), hanging the WebContent process. The early-return path is reached when `page.focusController().focusedOrMainFrame()` returns null, which happens for iframe-process BFCache restoration where the page's main frame is a RemoteFrame and there is no LocalFrame to focus. Fix: call `clear()` in the early-return branch to release the cached frame state, since `open()` has already done its work and the cached storage is no longer needed. 2209857 1 basuke 2026-05-11 14:50:15 -0700 Tracked in rdar://176824162 2209891 2 basuke 2026-05-11 16:05:46 -0700 <rdar://problem/176824162> 2209892 3 basuke 2026-05-11 16:06:15 -0700 Pull request: https://github.com/WebKit/WebKit/pull/64708 2209926 4 ews-feeder 2026-05-11 17:45:13 -0700 Committed 313043@main (11ea56301070): <https://commits.webkit.org/313043@main> Reviewed commits have been landed. Closing PR #64708 and removing active labels.