[Site Isolation] imported/w3c/web-platform-tests/navigation-timing/navigation-type-post-backforward.html fails on debug build
https://bugs.webkit.org/show_bug.cgi?id=327858
rdar://190247286

Reviewed by Per Arne Vollan.

With UseUIProcessForBackForwardItemLoading, the UI process sends a frame's FrameState to the web
process through two channels: GoToBackForwardItem, when the UI process initiates a traversal, and
PolicyDecision::backForwardFrameState, when a parent being restored delegates the load of a new
child frame to the UI process (dispatchDecidePolicyForBackForwardNavigationAction). However,
decidePolicyForNavigationAction attaches the FrameState to any back/forward policy decision of a
child frame, so for a traversal initiated by the UI process, the web process receives it twice.

The web process creates a HistoryItem from each copy. HistoryController::goToItem passes the first
one to FrameLoader::loadItem, which uses it as both the requested and the provisional history item.
WebFrame::didReceivePolicyDecision then replaces the requested history item with the second one,
while the provisional history item remains the first one. When the target item has form data and
the cache-only load fails, FrameLoader::retryAfterFailedCacheOnlyMainResourceLoad hits
ASSERT(history().provisionalItem() == m_requestedHistoryItem). This happens in
imported/w3c/web-platform-tests/navigation-timing/navigation-type-post-backforward.html, where an
iframe goes back to the result of a POST form submission.

To fix this, do not attach the FrameState to the policy decision when the navigation identifier maps
to a navigation with backForwardTraversalWasDispatched() set, meaning the UI process has already
sent GoToBackForwardItem for it. The delegated child frame load has no navigation identifier, so it
still gets the FrameState. The FrameState is still stored on the navigation, as
continueNavigationInNewProcess needs it when the traversal swaps process.

Covered by existing test: imported/w3c/web-platform-tests/navigation-timing/navigation-type-post-backforward.html

* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::decidePolicyForNavigationAction):

Canonical link: https://commits.webkit.org/324029@main