RESOLVED FIXED314584
[Site Isolation] WebPage::frameTreeSyncDataChangedInAnotherProcess should not ASSERT on stale cross-process IPC
https://bugs.webkit.org/show_bug.cgi?id=314584
Summary [Site Isolation] WebPage::frameTreeSyncDataChangedInAnotherProcess should not...
Basuke Suzuki
Reported 2026-05-11 14:41:56 PDT
WebPage::frameTreeSyncDataChangedInAnotherProcess ASSERTs ASSERT(frame->page() == this); But cross-process frame-tree sync messages can legitimately arrive at a WebPage that no longer owns the WebFrame. This happens during multi-process BFCache lifecycle transitions where two sibling WebPages exist in the same process (one suspended, one active), and a sync message originally routed for one view arrives at the other after a suspend/restore transition. The ASSERT crashes the WebContent process in Debug. In Release the ASSERT is compiled out and the function silently performs `coreFrame->updateFrameTreeSyncData(data)` on a frame in a different WebPage, which is harmless because the frame's own WebPage will receive the same update through its own IPC routing. Fix: convert the ASSERT to a soft-check that returns early on mismatch, so the function consistently ignores stale/mis-routed updates in both Debug and Release. Aligns with the defensive-coding pattern used elsewhere for cross-process IPC routing during page lifecycle transitions.
Attachments
Basuke Suzuki
Comment 1 2026-05-11 14:50:21 PDT
Tracked in rdar://176824128
Basuke Suzuki
Comment 2 2026-05-11 17:34:06 PDT
Basuke Suzuki
Comment 3 2026-05-11 17:34:40 PDT
EWS
Comment 4 2026-05-11 18:44:52 PDT
Committed 313048@main (e403c05b190e): <https://commits.webkit.org/313048@main> Reviewed commits have been landed. Closing PR #64718 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.