Bug 53708

Summary: HistoryController does not commit provisional item on same document navigation in subframe
Product: WebKit Reporter: Charles Reis <creis>
Component: HistoryAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: beidson, fishd, mihaip, priyajeet.hora
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   

Description Charles Reis 2011-02-03 12:58:12 PST
As reported from http://code.google.com/p/chromium/issues/detail?id=71759:

Test case url : https://bug-40451-attachments.webkit.org/attachment.cgi?id=58498

What steps will reproduce the problem?
1. Go to that test case URL
2. Press the navigate button inside the iframe
3. Press the browser back button
4. Press the browser forward button

The navigation fails because the parent frame never commits its HistoryController's provisional item after step 3.  (It currently crashes on step 4 because of a related memory error that is being fixed in bug 52819.)

Navigations in subframes set provisional items in their parent frames (as of http://trac.webkit.org/changeset/75336).  We need to commit these provisional items in the frame tree during updateForSameDocumentNavigation, similar to updateForCommit.
Comment 1 Charles Reis 2011-02-04 17:46:26 PST
I ended up including the fix for this as part of attachment 81286 [details] for bug 52819.  Committed in r77705:
<http://trac.webkit.org/changeset/77705>