RESOLVED FIXED306679
Cross-site iframe navigation history is incorrectly pruned from BackForwardList without BackForwardCache. 
https://bugs.webkit.org/show_bug.cgi?id=306679
Summary Cross-site iframe navigation history is incorrectly pruned from BackForwardLi...
Basuke Suzuki
Reported 2026-01-30 21:06:43 PST
When an iframe navigates cross-site (e.g., from localhost:8000 to 127.0.0.1:8000), the navigation history for that iframe is incorrectly deleted from the BackForwardList when the main frame subsequently navigates to a different page. This regression was introduced in r288547 (bug 285469) when sharesAncestor() replaced hasAncestorFrame() for pruning remote frame navigations. The new logic fails because when navigating to a new main frame (which has no parent), sharesAncestor() always returns false for any remote frame navigation item, causing all such items to be incorrectly pruned. # steps to reproduce 0. No BackForward Cache. 1. page A with same-site iframe . 2. iframe navigation to cross-site. 3. main frame navigation to B. 4. history.back() It should be 2, but it goes to 1.
Attachments
Add attachment proposed patch, testcase, etc.
Basuke Suzuki
Comment 1 2026-01-30 21:27:33 PST
rdar://169328011
Basuke Suzuki
Comment 2 2026-01-30 21:29:24 PST
Pull request: https://github.com/WebKit/WebKit/pull/57613
EWS
Comment 3 2026-02-02 16:21:59 PST
Committed 306664@main (cf1683ccb688): <https://commits.webkit.org/306664@main> Reviewed commits have been landed. Closing PR #57613 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.