Bug 314584

Summary: [Site Isolation] WebPage::frameTreeSyncDataChangedInAnotherProcess should not ASSERT on stale cross-process IPC
Product: WebKit Reporter: Basuke Suzuki <basuke>
Component: WebKit2Assignee: Basuke Suzuki <basuke>
Status: RESOLVED FIXED    
Severity: Normal CC: kkinnunen, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Basuke Suzuki
Reported 2026-05-11 14:41:56 PDT
WebPage::frameTreeSyncDataChangedInAnotherProcess ASSERTs ASSERT(frame->page() == this); But cross-process frame-tree sync messages can legitimately arrive at a WebPage that no longer owns the WebFrame. This happens during multi-process BFCache lifecycle transitions where two sibling WebPages exist in the same process (one suspended, one active), and a sync message originally routed for one view arrives at the other after a suspend/restore transition. The ASSERT crashes the WebContent process in Debug. In Release the ASSERT is compiled out and the function silently performs `coreFrame->updateFrameTreeSyncData(data)` on a frame in a different WebPage, which is harmless because the frame's own WebPage will receive the same update through its own IPC routing. Fix: convert the ASSERT to a soft-check that returns early on mismatch, so the function consistently ignores stale/mis-routed updates in both Debug and Release. Aligns with the defensive-coding pattern used elsewhere for cross-process IPC routing during page lifecycle transitions.
Attachments
Basuke Suzuki
Comment 1 2026-05-11 14:50:21 PDT
Tracked in rdar://176824128
Basuke Suzuki
Comment 2 2026-05-11 17:34:06 PDT
Basuke Suzuki
Comment 3 2026-05-11 17:34:40 PDT
EWS
Comment 4 2026-05-11 18:44:52 PDT
Committed 313048@main (e403c05b190e): <https://commits.webkit.org/313048@main> Reviewed commits have been landed. Closing PR #64718 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.