[webkit-changes] [WebKit/WebKit] 2dbbdb: REGRESSION (iOS 16.4): Chrome crashes in WebBackFo...

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 2dbbdbf493dbbebdaba039efa0e0b35bfa9fce53
      https://github.com/WebKit/WebKit/commit/2dbbdbf493dbbebdaba039efa0e0b35bfa9fce53
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2023-04-07 (Fri, 07 Apr 2023)

  Changed paths:
    M Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm

  Log Message:
  -----------
  REGRESSION (iOS 16.4): Chrome crashes in WebBackForwardCache::takeSuspendedPage
https://bugs.webkit.org/show_bug.cgi?id=255102
rdar://107723629

Reviewed by Geoffrey Garen.

We recently added an AddAllowedFirstPartyForCookies async IPC call inside
WebProcessPool::processForNavigation(), right after we decide which process to
use. Because the IPC is async, this means that the selected process may crash
while we're waiting for a response. If this happens, we now call
processForNavigation() again to select a new process instead of trying to
proceed with the navigation with the terminated process.

Similarly, also make sure that the destination suspendedPage is still valid
after receiving the async IPC, in case the back/forward cache got cleared
during the IPC (e.g. due to memory pressure).

* Source/WebKit/UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::processForNavigation):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

Canonical link: https://commits.webkit.org/262709@main