PatchGap
← WebKit — 2026-W35

0988eec0c5a2100add99512ec7ebc3944242dc6d  REGRESSION(316854@main): Frame CertificateInfo is empty after process swap on navigation

severity low class Spoofing confidence 0.3 signal score 7.67 Source/WebKit/UIProcess
view commit ↗
Primitive: certificate info for process-swap-on-navigation-response threaded explicitly instead of copied from old frame
Triage note: Threads a CertificateInfo through ProvisionalPageProxy and replaces copyCertificateInfoForProcessSwapOnNavigationResponse with setCertificateInfoForProcessSwapOnNavigationResponse. Concerns correct TLS cert propagation across PSON (security UI), but is essentially parameter plumbing with no concrete fixed bug.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.2)

Commit message

REGRESSION(316854@main): Frame CertificateInfo is empty after process swap on navigation
https://bugs.webkit.org/show_bug.cgi?id=321395

Reviewed by Alex Christensen.

When continuing a load on new process after a process swap on navigation
response, the provisional certificate used for the new frame proxy is
copied from the previous committed load, but the new certificate was
actually received from the network process in the previous provisional frame.
If there's a previous provisional frame having a provisional certificate
received from the network process it should be used, falling back to the
previous commited frame otherwise. This patch handles both cases from
continueNavigationInNewProcess(), passing the certitifate info to the
new ProvisionalPageProxy construtor.

* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::ProvisionalPageProxy):
* Source/WebKit/UIProcess/ProvisionalPageProxy.h:
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::provisionalCertificateInfoFromNetworkProcess const):
(WebKit::WebFrameProxy::commitCertificateInfo):
(WebKit::WebFrameProxy::setCertificateInfoForProcessSwapOnNavigationResponse):
(WebKit::WebFrameProxy::certificateInfoFromNetworkProcess const): Deleted.
(WebKit::WebFrameProxy::copyCertificateInfoForProcessSwapOnNavigationResponse): Deleted.
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::continueNavigationInNewProcess):

Canonical link: https://commits.webkit.org/319946@main

Before / after

Loading diff…
On This Page