315849 2026-05-29 07:39:27 -0700 [EME] Crash pruning a back/forward-cached page that owns an open MediaKeySession 2026-06-02 02:13:13 -0700 1 1 1 Unclassified WebKit Media WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 spena spena webkit-bug-importer oldest_to_newest 2215712 0 spena 2026-05-29 07:39:27 -0700 WebProcess crash (debug/asserts build) when a back/forward-cached page that still owns an open MediaKeySession is pruned instead of restored: ASSERTION FAILED: !activeDOMObjectsAreSuspended() || scriptExecutionContext()->eventLoop().isSuspended() Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp(86) : void WebCore::DeferredPromise::callFunction(...) WebCore::DeferredPromise::callFunction(...) WebCore::DeferredPromise::resolve() WebCore::DOMPromiseProxy<WebCore::IDLUndefined>::resolve() WebCore::MediaKeySession::sessionClosed() WebCore::MediaKeySession::stop() WebCore::ScriptExecutionContext::stopActiveDOMObjects() WebCore::Document::commonTeardown() WebCore::CachedFrame::destroy() WebCore::CachedPage::~CachedPage() WebCore::BackForwardCache::prune(WebCore::PruningReason) Steps: open a MediaKeySession and observe session.closed, navigate away so the page enters the back/forward cache, then prune the cache (e.g. under memory pressure) instead of restoring. In release builds the closed-promise resolution is silently dropped instead. 2215718 1 spena 2026-05-29 07:58:40 -0700 Pull request: https://github.com/WebKit/WebKit/pull/66027 2216695 2 ews-feeder 2026-06-02 02:12:03 -0700 Committed 314352@main (b09929827ab5): <https://commits.webkit.org/314352@main> Reviewed commits have been landed. Closing PR #66027 and removing active labels. 2216696 3 webkit-bug-importer 2026-06-02 02:13:13 -0700 <rdar://problem/178505550>