From 8f32771f758cd25294e982568b81b2522cd8659d Mon Sep 17 00:00:00 2001
From: Test User <[email protected]>
Date: Wed, 01 Jul 2026 18:25:16 -0700
Subject: [PATCH] Handle freeze/resume requests for dedicated workers before their thread initialization.

Currently, when DedicatedWorkerMessagingProxy::Freeze() or Resume() is
called before the worker thread is initialized, the request is ignored
because GetWorkerThread() returns nullptr.

To address this, this CL:
- Introduces pending_freeze_is_in_back_forward_cache_ to store the
  requested freeze state when the worker thread is not yet available.
- Applies the stored freeze state to the worker thread when it is
  started in StartWorkerGlobalScope().
- Resets the stored state if Resume() is called before thread
  initialization.
- Adds a browser test to verify the freeze behavior for nested workers.

Fixed: 517467117
Change-Id: I613ced93bd3c7a029570b49fa2194563f92fdd40
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7895623
Reviewed-by: Yoshisato Yanagisawa <[email protected]>
Commit-Queue: Minoru Chikamune <[email protected]>
Reviewed-by: Anna Sato <[email protected]>
Reviewed-by: Rakina Zata Amni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1655853}
---

diff --git a/content/browser/back_forward_cache_browsertest.cc b/content/browser/back_forward_cache_browsertest.cc
index 8b84b1f2..4e728d3 100644
--- a/content/browser/back_forward_cache_browsertest.cc
+++ b/content/browser/back_forward_cache_browsertest.cc
@@ -3731,6 +3731,92 @@
   EXPECT_TRUE(rfh_c->IsHistoryUserActivationActive());
 }
 
+// Test that a nested Dedicated Worker created while the parent is waiting for
+// its script fetch is correctly frozen when the page enters the Back-Forward
+// Cache.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       BFCacheBypassViaUnfrozenNestedWorker) {
+  net::test_server::ControllableHttpResponse w2_response(embedded_test_server(),
+                                                         "/w2.js");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url_a(embedded_test_server()->GetURL("a.com",
+                                            "/back_forward_cache/empty.html"));
+  GURL url_b(embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  // Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver deleted(rfh_a);
+
+  std::string w2_url = embedded_test_server()->GetURL("a.com", "/w2.js").spec();
+
+  // Create w1, which creates w2. Also set up a promise on A to listen for
+  // the message from w2 after we restore the page.
+  std::string js_script = R"(
+    window.receivedMsg = new Promise(resolve => {
+      const bc = new BroadcastChannel('bfcache_channel');
+      bc.onmessage = (e) => {
+        resolve(e.data);
+      };
+    });
+    const w1_code = `
+      const w2 = new Worker(')" +
+                          w2_url + R"(');
+    `;
+    const blob = new Blob([w1_code], {type: 'application/javascript'});
+    const w1 = new Worker(URL.createObjectURL(blob));
+    "done";
+  )";
+  EXPECT_TRUE(ExecJs(rfh_a, js_script));
+
+  // Wait for the request for w2.js to hit the server.
+  w2_response.WaitForRequest();
+
+  // Now w2 is pending fetch. Navigate to B to put A into BFCache.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+
+  // Ensure A is in BFCache.
+  EXPECT_FALSE(deleted.deleted());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+
+  // In active page B, set up a BroadcastChannel to verify the message is not
+  // received.
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+  EXPECT_TRUE(ExecJs(rfh_b, R"(
+    window.hasReceived = false;
+    const bc = new BroadcastChannel('bfcache_channel');
+    bc.onmessage = (e) => {
+      window.hasReceived = true;
+    };
+  )"));
+
+  // Now respond to the w2.js request.
+  w2_response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: application/javascript\r\n"
+      "\r\n"
+      "const bc = new BroadcastChannel('bfcache_channel');\n"
+      "bc.postMessage('Hello from nested worker!');\n");
+  w2_response.Done();
+
+  // Allow any outstanding tasks to execute on the renderer.
+  EXPECT_TRUE(ExecJs(rfh_b, "true"));
+
+  // Since A is in BFCache, w2 should be frozen and NOT run or send messages.
+  EXPECT_FALSE(EvalJs(rfh_b, "window.hasReceived").ExtractBool());
+
+  // Go back to page A.
+  ASSERT_TRUE(HistoryGoBack(shell()->web_contents()));
+  ExpectRestored(FROM_HERE);
+
+  // Once page A is restored (and unfrozen), w2 should resume and send the
+  // message.
+  std::string result = EvalJs(rfh_a, "window.receivedMsg").ExtractString();
+  EXPECT_EQ("Hello from nested worker!", result);
+}
+
 // BEFORE ADDING A NEW TEST HERE
 // Read the note at the top about the other files you could add it to.
 }  // namespace content
diff --git a/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc b/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc
index 4255301..4b30b69 100644
--- a/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc
+++ b/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc
@@ -116,6 +116,11 @@
     return;
   }
 
+  if (pending_freeze_is_in_back_forward_cache_.has_value()) {
+    GetWorkerThread()->Freeze(*pending_freeze_is_in_back_forward_cache_);
+    pending_freeze_is_in_back_forward_cache_.reset();
+  }
+
   // Step 13: "Obtain script by switching on the value of options's type
   // member:"
   if (options->type() == V8WorkerType::Enum::kClassic) {
@@ -216,16 +221,26 @@
 void DedicatedWorkerMessagingProxy::Freeze(bool is_in_back_forward_cache) {
   DCHECK(IsParentContextThread());
   auto* worker_thread = GetWorkerThread();
-  if (AskedToTerminate() || !worker_thread)
+  if (AskedToTerminate()) {
     return;
+  }
+  if (!worker_thread) {
+    pending_freeze_is_in_back_forward_cache_ = is_in_back_forward_cache;
+    return;
+  }
   worker_thread->Freeze(is_in_back_forward_cache);
 }
 
 void DedicatedWorkerMessagingProxy::Resume() {
   DCHECK(IsParentContextThread());
   auto* worker_thread = GetWorkerThread();
-  if (AskedToTerminate() || !worker_thread)
+  if (AskedToTerminate()) {
     return;
+  }
+  if (!worker_thread) {
+    pending_freeze_is_in_back_forward_cache_.reset();
+    return;
+  }
   worker_thread->Resume();
 }
 
diff --git a/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.h b/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.h
index 1a76b79..5fdef33 100644
--- a/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.h
+++ b/third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.h
@@ -154,6 +154,9 @@
 
   // Pauses virtual time in parent context until the worker is initialized.
   WebScopedVirtualTimePauser virtual_time_pauser_;
+
+  // Tracks the freeze state when the worker thread is not yet created.
+  std::optional<bool> pending_freeze_is_in_back_forward_cache_;
 };
 
 }  // namespace blink

diff --git a/content/browser/back_forward_cache_browsertest.cc b/content/browser/back_forward_cache_browsertest.cc
index 8b84b1f2..4e728d3 100644
--- a/content/browser/back_forward_cache_browsertest.cc
+++ b/content/browser/back_forward_cache_browsertest.cc
@@ -3731,6 +3731,92 @@
   EXPECT_TRUE(rfh_c->IsHistoryUserActivationActive());
 }
 
+// Test that a nested Dedicated Worker created while the parent is waiting for
+// its script fetch is correctly frozen when the page enters the Back-Forward
+// Cache.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       BFCacheBypassViaUnfrozenNestedWorker) {
+  net::test_server::ControllableHttpResponse w2_response(embedded_test_server(),
+                                                         "/w2.js");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url_a(embedded_test_server()->GetURL("a.com",
+                                            "/back_forward_cache/empty.html"));
+  GURL url_b(embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  // Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver deleted(rfh_a);
+
+  std::string w2_url = embedded_test_server()->GetURL("a.com", "/w2.js").spec();
+
+  // Create w1, which creates w2. Also set up a promise on A to listen for
+  // the message from w2 after we restore the page.
+  std::string js_script = R"(
+    window.receivedMsg = new Promise(resolve => {
+      const bc = new BroadcastChannel('bfcache_channel');
+      bc.onmessage = (e) => {
+        resolve(e.data);
+      };
+    });
+    const w1_code = `
+      const w2 = new Worker(')" +
+                          w2_url + R"(');
+    `;
+    const blob = new Blob([w1_code], {type: 'application/javascript'});
+    const w1 = new Worker(URL.createObjectURL(blob));
+    "done";
+  )";
+  EXPECT_TRUE(ExecJs(rfh_a, js_script));
+
+  // Wait for the request for w2.js to hit the server.
+  w2_response.WaitForRequest();
+
+  // Now w2 is pending fetch. Navigate to B to put A into BFCache.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+
+  // Ensure A is in BFCache.
+  EXPECT_FALSE(deleted.deleted());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+
+  // In active page B, set up a BroadcastChannel to verify the message is not
+  // received.
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+  EXPECT_TRUE(ExecJs(rfh_b, R"(
+    window.hasReceived = false;
+    const bc = new BroadcastChannel('bfcache_channel');
+    bc.onmessage = (e) => {
+      window.hasReceived = true;
+    };
+  )"));
+
+  // Now respond to the w2.js request.
+  w2_response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: application/javascript\r\n"
+      "\r\n"
+      "const bc = new BroadcastChannel('bfcache_channel');\n"
+      "bc.postMessage('Hello from nested worker!');\n");
+  w2_response.Done();
+
+  // Allow any outstanding tasks to execute on the renderer.
+  EXPECT_TRUE(ExecJs(rfh_b, "true"));
+
+  // Since A is in BFCache, w2 should be frozen and NOT run or send messages.
+  EXPECT_FALSE(EvalJs(rfh_b, "window.hasReceived").ExtractBool());
+
+  // Go back to page A.
+  ASSERT_TRUE(HistoryGoBack(shell()->web_contents()));
+  ExpectRestored(FROM_HERE);
+
+  // Once page A is restored (and unfrozen), w2 should resume and send the
+  // message.
+  std::string result = EvalJs(rfh_a, "window.receivedMsg").ExtractString();
+  EXPECT_EQ("Hello from nested worker!", result);
+}
+
 // BEFORE ADDING A NEW TEST HERE
 // Read the note at the top about the other files you could add it to.
 }  // namespace content