2051908 - ProgressListener prematurely stops navigation on subframe location changes

Status: RESOLVED FIXED

(Remote Protocol :: Agent, defect, P3)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Noticed this bug while updating my patch on bug 1664165, and some web-platform tests still failing.

The ProgressListener class in remote/shared/Navigate.sys.mjs registers with NOTIFY_LOCATION on the top-level WebProgress. With this flag, onLocationChange receives location-change events from all frames — including subframes — not just the monitored top-level document.

When a subframe performs a same-document navigation (hash change, history.pushState, or history.replaceState), onLocationChange fires with LOCATION_CHANGE_SAME_DOCUMENT. The current code unconditionally calls stop() in that case, causing the navigation promise to resolve before the top-level document has finished loading.

To reproduce navigate to a page that loads an iframe which calls history.replaceState (e.g. /html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-history-replaceState.html in WPT). The navigation command (WebDriver:Navigate / browsingContext.navigate) returns before the page is ready, so any script the test runner injects immediately after (window.__wptrunner_process_next_event) does not exist yet, resulting in a TypeError.

To fix this we should update onLocationChange and skip the LOCATION_CHANGE_SAME_DOCUMENT handling when progress.browsingContext !== this.#webProgress.browsingContext — i.e. when the event originates from a subframe rather than the monitored top-level context.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Attachment: Bug 2051908 - [remote] Fix ProgressListener to ignore subframe location changes.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Actually the test /html/cross-origin-embedder-policy/require-corp.https.html shows a similar failure when using the ProgressListener. The page loads fine, but CORP blocks a subframe resource, causing a LOCATION_CHANGE_ERROR_PAGE event for the subframe's webProgress. The ProgressListener's onLocationChange picks this up as well without any subframe check and incorrectly aborts the navigation with "Reached error page: Address rejected".

Comment 3

[Intermittent Failures Robot]

1 failures were associated with this bug in the last 7 days.

Repository breakdown:

• try: 1

Table

	no_variant
linux2404-x86_64/asan	1

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=2051908&startday=2026-06-29&endday=2026-07-05&tree=all

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/523830467b4e
https://hg.mozilla.org/integration/autoland/rev/d4f8dc1b9bb7
[remote] Fix ProgressListener to ignore subframe location changes. r=jdescottes

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61086 for changes under testing/web-platform/tests

Comment 6

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/d4f8dc1b9bb7

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot