Bug 145948

Summary: [WK2] API::Navigation objects are leaked on history navigation to HistoryItems in PageCache
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: WebKit2Assignee: Chris Dumez <cdumez>
Severity: Normal CC: andersca, barraclough, commit-queue, japhet, kling, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=145977
Description Flags
WIP Patch
Patch none

Description Chris Dumez 2015-06-12 16:20:07 PDT
API::Navigation objects are leaked on history navigation to HistoryItems in PageCache.

When WebPageProxy::goBack() is called:
1. We create a back/forward navigation item by calling m_navigationState->createBackForwardNavigation()
2. We send WebPage::GoBack IPC to the WebContent process with the navigationID that was just created
3. WebPage::goBack() does NOT update m_pendingNavigationID because item->isInPageCache() return true. As a result, the navigationID is ignored.
4. In FrameLoader::loadDifferentDocumentItem(), we get a CachedPage from the PageCache and we reuse the cached DocumentLoader (instead of creating a new one)
5. WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction() is called later on. It sends WebPageProxy::DecidePolicyForNavigationAction IPC to the UIProcess with a navigationID that is 0 (instead of the actual navigationID of the BackForward Navigation object)
6. WebPageProxy::decidePolicyForNavigationAction() is called and since navigationID is 0, it constructors a new Navigation object by calling m_navigationState->createLoadRequestNavigation().

Later on, when navigating away, the LoadRequestNavigation object will be destroyed. However, the BackForwardNavigation object will be leaked.

Related to <rdar://problem/21305706> but likely a different reason for leaking.
Comment 1 Chris Dumez 2015-06-12 16:37:57 PDT
Created attachment 254833 [details]
WIP Patch

Upload WIP patch in case Sam / Anders have early feedback. It does fix the leak but I do not know much about those Navigation objects.
Comment 2 Chris Dumez 2015-06-12 20:47:59 PDT
Created attachment 254849 [details]
Comment 3 WebKit Commit Bot 2015-06-13 21:53:52 PDT
Comment on attachment 254849 [details]

Clearing flags on attachment: 254849

Committed r185542: <http://trac.webkit.org/changeset/185542>
Comment 4 WebKit Commit Bot 2015-06-13 21:53:58 PDT
All reviewed patches have been landed.  Closing bug.