Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d69cba4b8488ce0f698f1e741bce74083e3342d6
https://github.com/WebKit/WebKit/commit/d69cba4b8488ce0f698f1e741bce74083e3342d6
Author: Youenn Fablet <[email protected]>
Date: 2026-06-26 (Fri, 26 Jun 2026)
Changed paths:
A LayoutTests/http/tests/media/fairplay/fps-video-frame-expected.txt
A LayoutTests/http/tests/media/fairplay/fps-video-frame.html
M Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
Log Message:
-----------
Nullptr crash in SharedVideoFrameInfo::writePixelBuffer for protected
IOSurface
rdar://164306288
https://bugs.webkit.org/show_bug.cgi?id=317842
Reviewed by Jean-Yves Avenard.
Some IOSurfaces that are not readable by CPU will have their base address equal
to nullptr.
But their base address of plane would not be nullptr since an offset would be
added.
This breaks SharedVideoFrameInfo::writePixelBuffer which was only testing for
the plan address to not be nullptr.
We add a check that the base address is nullptr to prevent crashing the GPU
process.
The web process will then create a black pixel buffer instead in
RemoteVideoFrameProxy::pixelBuffer.
Covered by added test.
* LayoutTests/http/tests/media/fairplay/fps-video-frame-expected.txt: Added.
* LayoutTests/http/tests/media/fairplay/fps-video-frame.html: Added.
* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:
(WebCore::SharedVideoFrameInfo::writePixelBuffer):
Canonical link: https://commits.webkit.org/315886@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
