Changeset 278318 in webkit

Timestamp:

Jun 1, 2021, 12:02:38 PM (5 years ago)

Author:

Chris Dumez

Message:

REGRESSION (iOS 14.5): Can't go back and render previous page properly after "location.href"
​https://bugs.webkit.org/show_bug.cgi?id=226323
<rdar://problem/78623536>

Reviewed by Alex Christensen.

Source/WebKit:

A while back, we did an optimization to allow several WebPage objects associated with the
same WebPageProxy to live in the same WebProcess. This allowed us to reuse a process from
a SuspendedPageProxy for a forward navigation, without destroying the SuspendedPageProxy.
However, this added quite a bit of complexity and this broke some same-process back/forward
navigations like in this bug. In particular, it is really hard to get do our history
management right (with the current model) if there is more than more WebPage in a process
for the same WebPageProxy.

To address issues, we go back to the older model with one WebPage per WebProcess for a
given WebPageProxy. To achieve this, we make sure to destroy of SuspendedPageProxy objects
for the current page and destination process before we process-swap (like we used to do).

• UIProcess/WebBackForwardCache.cpp:

(WebKit::WebBackForwardCache::removeEntriesForPageAndProcess):

• UIProcess/WebBackForwardCache.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::receivedNavigationPolicyDecision):

Tools:

New API test written by Alex Christensen to cover this case.

• TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

Location:

trunk

Files:

• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/UIProcess/WebBackForwardCache.cpp (modified) (1 diff)
• Source/WebKit/UIProcess/WebBackForwardCache.h (modified) (1 diff)
• Source/WebKit/UIProcess/WebPageProxy.cpp (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-06-01  Chris Dumez  <cdumez@apple.com>
+
+        REGRESSION (iOS 14.5): Can't go back and render previous page properly after "location.href"
+        https://bugs.webkit.org/show_bug.cgi?id=226323
+        <rdar://problem/78623536>
+
+        Reviewed by Alex Christensen.
+
+        A while back, we did an optimization to allow several WebPage objects associated with the
+        same WebPageProxy to live in the same WebProcess. This allowed us to reuse a process from
+        a SuspendedPageProxy for a forward navigation, without destroying the SuspendedPageProxy.
+        However, this added quite a bit of complexity and this broke some same-process back/forward
+        navigations like in this bug. In particular, it is really hard to get do our history
+        management right (with the current model) if there is more than more WebPage in a process
+        for the same WebPageProxy.
+
+        To address issues, we go back to the older model with one WebPage per WebProcess for a
+        given WebPageProxy. To achieve this, we make sure to destroy of SuspendedPageProxy objects
+        for the current page and destination process before we process-swap (like we used to do).
+
+        * UIProcess/WebBackForwardCache.cpp:
+        (WebKit::WebBackForwardCache::removeEntriesForPageAndProcess):
+        * UIProcess/WebBackForwardCache.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::receivedNavigationPolicyDecision):
+
 2021-06-01  Sihui Liu  <sihui_liu@apple.com>
 

trunk/Source/WebKit/UIProcess/WebBackForwardCache.cpp

@@ -146 +146 @@
 }
 
+void WebBackForwardCache::removeEntriesForPageAndProcess(WebPageProxy& page, WebProcessProxy& process)
+{
+    removeEntriesMatching([pageID = page.identifier(), processIdentifier = process.coreProcessIdentifier()](auto& item) {
+        ASSERT(item.backForwardCacheEntry());
+        return item.pageID() == pageID && item.backForwardCacheEntry()->processIdentifier() == processIdentifier;
+    });
+}
+
 void WebBackForwardCache::removeEntriesMatching(const Function<bool(WebBackForwardListItem&)>& matches)
 {

trunk/Source/WebKit/UIProcess/WebBackForwardCache.h

@@ -54 +54 @@
     void removeEntriesForProcess(WebProcessProxy&);
     void removeEntriesForPage(WebPageProxy&);
+    void removeEntriesForPageAndProcess(WebPageProxy&, WebProcessProxy&);
     void removeEntriesForSession(PAL::SessionID);
 

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -3425 +3425 @@
             ASSERT(!destinationSuspendedPage || navigation->targetItem());
             auto suspendedPage = destinationSuspendedPage ? backForwardCache().takeSuspendedPage(*navigation->targetItem()) : nullptr;
+
+            // It is difficult to get history right if we have several WebPage objects inside a single WebProcess for the same WebPageProxy. As a result, if we make sure to
+            // clear any SuspendedPageProxy for the current page that are backed by the destination process before we proceed with the navigation. This makes sure the WebPage
+            // we are about to create in the destination process will be the only one associated with this WebPageProxy.
+            if (!destinationSuspendedPage)
+                backForwardCache().removeEntriesForPageAndProcess(*this, processForNavigation);
+
             ASSERT(suspendedPage.get() == destinationSuspendedPage);
             if (suspendedPage && suspendedPage->pageIsClosedOrClosing())

trunk/Tools/ChangeLog

@@ +1 @@
+2021-06-01  Chris Dumez  <cdumez@apple.com>
+
+        REGRESSION (iOS 14.5): Can't go back and render previous page properly after "location.href"
+        https://bugs.webkit.org/show_bug.cgi?id=226323
+        <rdar://problem/78623536>
+
+        Reviewed by Alex Christensen.
+
+        New API test written by Alex Christensen to cover this case.
+
+        * TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:
+
 2021-06-01  Aakash Jain  <aakash_jain@apple.com>
 

trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm

@@ -3352 +3352 @@
 }
 
+TEST(ProcessSwap, NavigateBackAfterCrossOriginClientRedirect)
+{
+    auto processPoolConfiguration = psonProcessPoolConfiguration();
+    auto processPool = adoptNS([[WKProcessPool alloc] _initWithConfiguration:processPoolConfiguration.get()]);
+
+    auto webViewConfiguration = adoptNS([[WKWebViewConfiguration alloc] init]);
+    [webViewConfiguration setProcessPool:processPool.get()];
+    auto handler = adoptNS([[PSONScheme alloc] init]);
+    [handler addMappingFromURLString:@"pson://webkit.org/navigated_from" toData:"<a href='pson://apple.com/'>hello</a>"];
+    [handler addMappingFromURLString:@"pson://apple.com/" toData:"<script>window.location.href='pson://webkit.org/redirected_to'</script>redirecting..."];
+    [handler addMappingFromURLString:@"pson://webkit.org/redirected_to" toData:"<p>hello again</p>"];
+    [webViewConfiguration setURLSchemeHandler:handler.get() forURLScheme:@"PSON"];
+
+    auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSMakeRect(0, 0, 800, 600) configuration:webViewConfiguration.get()]);
+
+    [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"pson://webkit.org/navigated_from"]]];
+    [webView _test_waitForDidFinishNavigation];
+
+    [webView evaluateJavaScript:@"document.querySelector('a').click()" completionHandler:nil];
+    [webView _test_waitForDidFinishNavigation];
+    [webView _test_waitForDidFinishNavigation];
+    EXPECT_WK_STREQ([webView objectByEvaluatingJavaScript:@"window.location.href"], "pson://webkit.org/redirected_to");
+    [webView goBack];
+    [webView _test_waitForDidFinishNavigation];
+    EXPECT_WK_STREQ([webView objectByEvaluatingJavaScript:@"window.location.href"], "pson://webkit.org/navigated_from");
+}
+
 TEST(ProcessSwap, BackForwardCacheSkipBackForwardListItem)
 {