Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b3a18597e2c6f3f95e9e085fc9fcf05fed24c99e
https://github.com/WebKit/WebKit/commit/b3a18597e2c6f3f95e9e085fc9fcf05fed24c99e
Author: Roberto Rodriguez <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M Source/ThirdParty/ANGLE/src/tests/gl_tests/TextureTest.cpp
Log Message:
-----------
Clear stale imageDef in TextureMtl::redefineImage fast path
https://bugs.webkit.org/show_bug.cgi?id=312951
rdar://174740372
Reviewed by Kimmo Kinnunen.
TextureMtl::retainImageDefinitions() populates mTexImageDefs with views of the
old native
storage when the base level is resized. These stale views can survive
ensureNativeStorageCreated() when their dimensions don't match the new storage.
A subsequent
texImage2D whose size matches the new storage takes the redefineImage() fast
path, fetches
the stale undersized view, and issues a replaceRegion against it resulting in
OOB write.
In the fast path, compare the cached view's size against the expected mip size
and clear the
entry when they differ. Valid views are left in place to avoid unnecessary
recreation.
* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/TextureMtl.mm:
(rx::TextureMtl::redefineImage):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/TextureTest.cpp:
Originally-landed-as: 305413.818@safari-7624-branch (656e32e254da).
rdar://180428246
Canonical link: https://commits.webkit.org/316260@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
