<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[243767] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/243767">243767</a></dd>
<dt>Author</dt> <dd>achristensen@apple.com</dd>
<dt>Date</dt> <dd>2019-04-02 16:11:43 -0700 (Tue, 02 Apr 2019)</dd>
</dl>

<h3>Log Message</h3>
<pre>Fix assertion in http/tests/adClickAttribution/store-ad-click-attribution.html
https://bugs.webkit.org/show_bug.cgi?id=196503

Reviewed by Chris Dumez.

Source/WebKit:

In WebPageProxy::didDestroyNavigation we try to ignore a request to destroy a navigation from a page being navigated from
during a cross-site navigation, but if the old web process sends the message after WebPageProxy::commitProvisionalPage
has been called, we can still destroy a navigation when we are continuing a navigation in another process.  To prevent this,
have the process not send the message when it knows the navigation is continuing in another process.
Also make the use of unchecked navigation pointers more robust by checking it for nullity.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didCommitLoadForFrame):
* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::didReceivePolicyDecision):
(WebKit::WebFrame::documentLoaderDetached):
* WebProcess/WebPage/WebFrame.h:

LayoutTests:

* http/tests/adClickAttribution/store-ad-click-attribution-expected.txt:
* http/tests/adClickAttribution/store-ad-click-attribution.html:
* platform/wk2/TestExpectations:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestshttptestsadClickAttributionstoreadclickattributionexpectedtxt">trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestsadClickAttributionstoreadclickattributionhtml">trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution.html</a></li>
<li><a href="#trunkLayoutTestsplatformwk2TestExpectations">trunk/LayoutTests/platform/wk2/TestExpectations</a></li>
<li><a href="#trunkSourceWebKitChangeLog">trunk/Source/WebKit/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitUIProcessWebPageProxycpp">trunk/Source/WebKit/UIProcess/WebPageProxy.cpp</a></li>
<li><a href="#trunkSourceWebKitWebProcessWebPageWebFramecpp">trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp</a></li>
<li><a href="#trunkSourceWebKitWebProcessWebPageWebFrameh">trunk/Source/WebKit/WebProcess/WebPage/WebFrame.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog      2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/LayoutTests/ChangeLog 2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2019-04-02  Alex Christensen  <achristensen@webkit.org>
+
+        Fix assertion in http/tests/adClickAttribution/store-ad-click-attribution.html
+        https://bugs.webkit.org/show_bug.cgi?id=196503
+
+        Reviewed by Chris Dumez.
+
+        * http/tests/adClickAttribution/store-ad-click-attribution-expected.txt:
+        * http/tests/adClickAttribution/store-ad-click-attribution.html:
+        * platform/wk2/TestExpectations:
+
</ins><span class="cx"> 2019-04-02  Devin Rousso  <drousso@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Web Inspector: Canvas: add support for showing WebGPU contexts
</span></span></pre></div>
<a id="trunkLayoutTestshttptestsadClickAttributionstoreadclickattributionexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution-expected.txt (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution-expected.txt  2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution-expected.txt     2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -1,8 +1,4 @@
</span><span class="cx"> Tests storage of ad click attribution.
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-WebCore::AdClickAttribution 1
-Source: 127.0.0.1
-Destination: localhost
-Campaign ID: 3
-No conversion data.
</del><ins>+No stored Ad Click Attribution data.
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="trunkLayoutTestshttptestsadClickAttributionstoreadclickattributionhtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution.html (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution.html  2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/LayoutTests/http/tests/adClickAttribution/store-ad-click-attribution.html     2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -1,4 +1,4 @@
</span><del>-<!DOCTYPE html> <!-- webkit-test-runner [ useFlexibleViewport=true, internal:AdClickAttributionEnabled=true ] -->
</del><ins>+<!DOCTYPE html> <!-- webkit-test-runner [ useFlexibleViewport=true internal:AdClickAttributionEnabled=true ] -->
</ins><span class="cx"> <html lang="en">
</span><span class="cx"> <head>
</span><span class="cx">     <meta charset="UTF-8">
</span></span></pre></div>
<a id="trunkLayoutTestsplatformwk2TestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/wk2/TestExpectations (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/wk2/TestExpectations  2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/LayoutTests/platform/wk2/TestExpectations     2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -753,7 +753,6 @@
</span><span class="cx"> fast/forms/call-text-did-change-in-text-field-when-typing.html [ Pass ]
</span><span class="cx"> 
</span><span class="cx"> http/tests/adClickAttribution [ Pass ]
</span><del>-http/tests/adClickAttribution/store-ad-click-attribution.html [ Skip ]
</del><span class="cx"> 
</span><span class="cx"> ### END OF (5) Progressions, expected successes that are expected failures in WebKit1.
</span><span class="cx"> ########################################
</span></span></pre></div>
<a id="trunkSourceWebKitChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/ChangeLog (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/ChangeLog    2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/Source/WebKit/ChangeLog       2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2019-04-02  Alex Christensen  <achristensen@webkit.org>
+
+        Fix assertion in http/tests/adClickAttribution/store-ad-click-attribution.html
+        https://bugs.webkit.org/show_bug.cgi?id=196503
+
+        Reviewed by Chris Dumez.
+
+        In WebPageProxy::didDestroyNavigation we try to ignore a request to destroy a navigation from a page being navigated from
+        during a cross-site navigation, but if the old web process sends the message after WebPageProxy::commitProvisionalPage
+        has been called, we can still destroy a navigation when we are continuing a navigation in another process.  To prevent this,
+        have the process not send the message when it knows the navigation is continuing in another process.
+        Also make the use of unchecked navigation pointers more robust by checking it for nullity.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didCommitLoadForFrame):
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::didReceivePolicyDecision):
+        (WebKit::WebFrame::documentLoaderDetached):
+        * WebProcess/WebPage/WebFrame.h:
+
</ins><span class="cx"> 2019-04-02  Per Arne Vollan  <pvollan@apple.com>
</span><span class="cx"> 
</span><span class="cx">         [iOS] Fix iokit-get-properties sandbox violation in the WebContent process
</span></span></pre></div>
<a id="trunkSourceWebKitUIProcessWebPageProxycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.cpp (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/UIProcess/WebPageProxy.cpp   2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.cpp      2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -3873,10 +3873,6 @@
</span><span class="cx"> {
</span><span class="cx">     PageClientProtector protector(pageClient());
</span><span class="cx"> 
</span><del>-    // On process-swap, the previous process tries to destroy the navigation but the provisional process is actually taking over the navigation.
-    if (m_provisionalPage && m_provisionalPage->navigationID() == navigationID)
-        return;
-
</del><span class="cx">     // FIXME: Message check the navigationID.
</span><span class="cx">     m_navigationState->didDestroyNavigation(navigationID);
</span><span class="cx"> }
</span><span class="lines">@@ -4106,8 +4102,7 @@
</span><span class="cx"> 
</span><span class="cx">     // FIXME: We should message check that navigationID is not zero here, but it's currently zero for some navigations through the page cache.
</span><span class="cx">     RefPtr<API::Navigation> navigation;
</span><del>-    if (frame->isMainFrame() && navigationID) {
-        navigation = navigationState().navigation(navigationID);
</del><ins>+    if (frame->isMainFrame() && navigationID && (navigation = navigationState().navigation(navigationID))) {
</ins><span class="cx"> #if ENABLE(RESOURCE_LOAD_STATISTICS)
</span><span class="cx">         auto requesterOrigin = navigation->lastNavigationAction().requesterOrigin;
</span><span class="cx">         auto currentURL = navigation->currentRequest().url();
</span></span></pre></div>
<a id="trunkSourceWebKitWebProcessWebPageWebFramecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp      2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp 2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -278,6 +278,9 @@
</span><span class="cx">             documentLoader->setNavigationID(navigationID);
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    if (action == PolicyAction::StopAllLoads)
+        m_navigationIsContinuingInAnotherProcess = true;
+
</ins><span class="cx">     function(action, identifier);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -812,7 +815,9 @@
</span><span class="cx"> 
</span><span class="cx"> void WebFrame::documentLoaderDetached(uint64_t navigationID)
</span><span class="cx"> {
</span><del>-    if (auto * page = this->page())
</del><ins>+    if (m_navigationIsContinuingInAnotherProcess)
+        return;
+    if (auto* page = this->page())
</ins><span class="cx">         page->send(Messages::WebPageProxy::DidDestroyNavigation(navigationID));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebKitWebProcessWebPageWebFrameh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/WebProcess/WebPage/WebFrame.h (243766 => 243767)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/WebProcess/WebPage/WebFrame.h        2019-04-02 23:07:49 UTC (rev 243766)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebFrame.h   2019-04-02 23:11:43 UTC (rev 243767)
</span><span class="lines">@@ -188,6 +188,7 @@
</span><span class="cx">     LoadListener* m_loadListener { nullptr };
</span><span class="cx">     
</span><span class="cx">     uint64_t m_frameID { 0 };
</span><ins>+    bool m_navigationIsContinuingInAnotherProcess { false };
</ins><span class="cx"> 
</span><span class="cx"> #if PLATFORM(IOS_FAMILY)
</span><span class="cx">     uint64_t m_firstLayerTreeTransactionIDAfterDidCommitLoad { 0 };
</span></span></pre>
</div>
</div>

</body>
</html>