Bug 309791 – Send only the target frame's FrameState during UIProcess-driven back/forward navigation

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Basuke Suzuki]

Currently, `goToBackForwardItem` sends the full FrameState tree (including all children) to the WebProcess. Under site isolation, this means a WebProcess receives FrameState for cross-site child frames, which violates the security principle that a process should only have access to same-site content.

[Basuke Suzuki]

When `UseUIProcessForBackForwardItemLoading` is enabled, each child frame receives its own FrameState individually from the UIProcess via `dispatchDecidePolicyForBackForwardNavigationAction`, so the children in the tree are no longer needed. This patch takes advantage of that to stop sending child FrameStates to the WebProcess:

1. In `WebPageProxy::goToBackForwardItem`, use `copyFrameState()` (without children) instead of `copyFrameStateWithChildren()` when `useUIProcessForBackForwardItemLoading` is enabled.

2. In `FrameLoader::setRequestedHistoryItem`, reconstruct the parent-child HistoryItem tree by adding each child's HistoryItem to its parent's current HistoryItem via `setChildItem`. This ensures the HistoryItem tree after a back/forward navigation matches the structure that `createItemTree` would have produced during a normal navigation. Also adds an assertion that `loadChildHistoryItemIntoFrame` — which walks the tree to find child items — is not called when the flag is enabled, since child items are delivered individually rather than through tree traversal.

[Basuke Suzuki]

<rdar://problem/171032743>

[Basuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/60562

[EWS]

Committed 309344@main (ea9560f77928): <https://commits.webkit.org/309344@main>

Reviewed commits have been landed. Closing PR #60562 and removing active labels.