Site Isolation: multi-process BFCache restoration

fceeb85

Source/WebKit/UIProcess/SuspendedPageProxy.cpp

-void SuspendedPageProxy::unsuspend()
+void SuspendedPageProxy::unsuspend(WebCore::BackForwardFrameItemIdentifier mainFrameItemID)
 {
     sendWithAsyncReply(Messages::WebPage::SetIsSuspended(false), [](std::optional<bool> didSuspend) {
         ASSERT(!didSuspend.has_value());
     });
+    auto aggregator = MainRunLoopSuccessCallbackAggregator::create([weakPage = m_page](bool success) {
+        if (success) return;
+        RefPtr page = weakPage.get();
+        if (!page) return;
+        page->reload(WebCore::ReloadOption::ExpiredOnly);
+    });
+    m_browsingContextGroup->forEachRemotePage(*page, [...](auto& remotePage) {
         // sends RestoreWithFrameItem to each subframe process
     });

Source/WebKit/UIProcess/BrowsingContextGroup.cpp

 void BrowsingContextGroup::addPage(WebPageProxy& page)
 {
-    ASSERT(!m_pages.contains(page));
+    if (m_pages.contains(page)) {
+        ASSERT(!hasMultiplePages());
+        return;
+    }
     m_pages.add(page);

BFCache (Back-Forward Cache) preserves a full page snapshot in memory so back/forward navigation is instant. Under Site Isolation, cross-origin iframes run in separate WebContent processes, so a cached page can span N processes. SuspendedPageProxy is the UIProcess object that holds the suspended state; BrowsingContextGroup (BCG) tracks process-group membership and routes RemotePageProxy references. Previously restoration only handled the main-frame process. This commit splits the single SetIsSuspended IPC into separate SuspendWithFrameItem and RestoreWithFrameItem messages, fans RestoreWithFrameItem out to every subframe process via forEachRemotePage, and uses a MainRunLoopSuccessCallbackAggregator to trigger a full reload if any process fails to restore. The suspended page's BCG is reused for the new navigation so existing RemotePageProxy handles remain valid.

Significance

Restoration now coordinates suspend/resume across N WebContent processes simultaneously, expanding the multi-process boundary surface that has to remain consistent for cross-origin isolation to hold.

Audit directions

ASSERT(!hasMultiplePages()) is debug-only. In release builds, if the "suspended BCG holds exactly one page" invariant is violated — via a re-entrant navigation or a race between suspension and a new page attach — the code silently returns and a page is already in the BCG under an unexpected condition. Process routing can be corrupted without any observable error. Audit every caller of addPage for ways the invariant can be reached.
Partial restoration window. SetIsSuspended(false) dispatches to the main frame process before the aggregator is created and before subframe RestoreWithFrameItem messages are sent. If a subframe then fails, the aggregator fires page->reload(ExpiredOnly) on an already-live main frame. The mixed-state window where main frame is restored but subframes are in an unknown state is worth examining for navigation or script execution that lands in the gap.
removeEntriesForPageAndProcess narrowed to main frame only. The guard change means cross-site iframe process swaps no longer evict main-frame BFCache entries from the destination process. Stale BFCache entries could accumulate if a process is recycled and reused for a different origin, potentially surfacing cached state to the wrong origin.
BCG reuse during restoration. Using the suspended page's BCG for the new navigation means RemotePageProxy references established before suspension remain bound during restore. A navigation that starts as a BFCache hit but transitions to a network load mid-flight could route subframe processes into the wrong context group, weakening cross-origin isolation.