diff --git a/content/public/browser/disallow_activation_reason.h b/content/public/browser/disallow_activation_reason.h index 1ff1f7ed2b251..f678a40a9362c 100644 --- a/content/public/browser/disallow_activation_reason.h +++ b/content/public/browser/disallow_activation_reason.h @@ -65,6 +65,7 @@ enum DisallowActivationReasonId : uint64_t { kIndexedDBTransactionIsOngoingAndBlockingOthers = 41, kBrowserInitiatedErrorPage = 42, kDidChangeOpener = 43, + kDidCommitProvisionalLoad = 44, // New entries go above here. New entries should be added to // tools/metrics/histograms/enums.xml . kMinEmbedderDisallowActivationReason = 2 << 16, diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc index 8949727d76136..d3a9ad9ee006e 100644 --- a/content/browser/renderer_host/render_frame_host_impl.cc +++ b/content/browser/renderer_host/render_frame_host_impl.cc @@ -6405,6 +6405,21 @@ bool RenderFrameHostImpl::IsFrozen() { void RenderFrameHostImpl::DidCommitProvisionalLoad( mojom::DidCommitProvisionalLoadParamsPtr params, mojom::DidCommitProvisionalLoadInterfaceParamsPtr interface_params) { + // This Mojo method is renderer-callable on the channel-associated FrameHost + // interface and is only legitimately used for the synchronous about:blank + // commit on the initial empty document. All other commits arrive via the + // NavigationClient callback bound for a specific browser-initiated + // NavigationRequest. A page in the back/forward cache has no documents that + // could legitimately perform a synchronous about:blank commit, so reject the + // IPC the same way DidCommitSameDocumentNavigation() and OnCreateChildFrame() + // already do, evicting the page from the cache rather than letting the + // commit dispatch into the *primary* FrameTree's NavigationController. + if (lifecycle_state() != LifecycleStateImpl::kPrerendering && + IsInactiveAndDisallowActivation( + DisallowActivationReasonId::kDidCommitProvisionalLoad)) { + return; + } + if (!MaybeInterceptCommitCallback(nullptr, ¶ms, &interface_params)) { return; }