[Webkit-unassigned] [Bug 53708] New: HistoryController does not commit provisional item on same document navigation in subframe

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=53708

           Summary: HistoryController does not commit provisional item on
                    same document navigation in subframe
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: History
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: creis at chromium.org
                CC: beidson at apple.com, fishd at chromium.org,
                    mihaip at chromium.org


As reported from http://code.google.com/p/chromium/issues/detail?id=71759:

Test case url : https://bug-40451-attachments.webkit.org/attachment.cgi?id=58498

What steps will reproduce the problem?
1. Go to that test case URL
2. Press the navigate button inside the iframe
3. Press the browser back button
4. Press the browser forward button

The navigation fails because the parent frame never commits its HistoryController's provisional item after step 3.  (It currently crashes on step 4 because of a related memory error that is being fixed in bug 52819.)

Navigations in subframes set provisional items in their parent frames (as of http://trac.webkit.org/changeset/75336).  We need to commit these provisional items in the frame tree during updateForSameDocumentNavigation, similar to updateForCommit.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.