Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 1519d5331824bb48ef17ace35406effa1eacdb77
https://github.com/WebKit/WebKit/commit/1519d5331824bb48ef17ace35406effa1eacdb77
Author: Claudio Saavedra <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
A
LayoutTests/compositing/canvas/resize-canvas-with-unrealized-saves-crash-expected.txt
A
LayoutTests/compositing/canvas/resize-canvas-with-unrealized-saves-crash.html
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
Log Message:
-----------
Cherry-pick 308314@main (b5da4b256925).
https://bugs.webkit.org/show_bug.cgi?id=308741
REGRESSION(307450@main): CanvasRenderingContext2D does not account for
unrealized saves when resetting the context
https://bugs.webkit.org/show_bug.cgi?id=308741
Reviewed by Kimmo Kinnunen.
When canvas size dimensions are modified the rendering context stack
needs to be restored. However, if there are unrealized saves, the
check at the beginning of CanvasRenderingContext2DBase::restore()
will short-circuit and leave the state inconsistent after the image
buffer is reset or removed.
Resetting the counter for unrealized saves before the restore call
loop prevents this.
Test: compositing/canvas/resize-canvas-with-unrealized-saves-crash.html
*
LayoutTests/compositing/canvas/resize-canvas-with-unrealized-saves-crash-expected.txt:
Added.
*
LayoutTests/compositing/canvas/resize-canvas-with-unrealized-saves-crash.html:
Added.
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::~CanvasRenderingContext2DBase):
(WebCore::CanvasRenderingContext2DBase::didUpdateCanvasSizeProperties):
Canonical link: https://commits.webkit.org/308314@main
Canonical link: https://commits.webkit.org/305877.945@webkitglib/2.52
Commit: 498b2bb7de713ba5fac2e09adfe7ab2d5911856c
https://github.com/WebKit/WebKit/commit/498b2bb7de713ba5fac2e09adfe7ab2d5911856c
Author: Kimmo Kinnunen <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
Log Message:
-----------
Cherry-pick 308389@main (673b8d7495af).
https://bugs.webkit.org/show_bug.cgi?id=308815
REGRESSION(307450@main): webgl/1.0.x/conformance/context/context-lost.html
crashes
https://bugs.webkit.org/show_bug.cgi?id=308815
rdar://171345790
Reviewed by Cameron McCormack.
After context loss, canvas resizes would not affect default framebuffer
size. This would cause the HTMLCanvasElement / OffscreenCanvas
image to remain the old size.
The test would call texImage2D with the lost canvas. This would
ASSERT that the element size would be same as the image size.
The element size would follow the resized size, where as the image
size would be the old size.
Fix by ensure the saved images of the context are discarded on resize, even
if the context is lost.
Tests:
webgl/1.0.x/conformance/context/context-lost.html
* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::surfaceBufferToImageBuffer):
(WebCore::WebGLRenderingContextBase::didUpdateCanvasSizeProperties):
(WebCore::WebGLRenderingContextBase::updateMemoryCost const):
Canonical link: https://commits.webkit.org/308389@main
Canonical link: https://commits.webkit.org/305877.946@webkitglib/2.52
Commit: 43ecdf1cf53a081c39cb9338c8468fb463feec07
https://github.com/WebKit/WebKit/commit/43ecdf1cf53a081c39cb9338c8468fb463feec07
Author: Kimmo Kinnunen <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M LayoutTests/TestExpectations
R LayoutTests/fast/canvas/webgl/context-lost.html
M Source/WebCore/html/canvas/OESVertexArrayObject.cpp
M Source/WebCore/html/canvas/OESVertexArrayObject.h
M Source/WebCore/html/canvas/OESVertexArrayObject.idl
M Source/WebCore/html/canvas/WebGL2RenderingContext.cpp
M Source/WebCore/html/canvas/WebGL2RenderingContext.h
M Source/WebCore/html/canvas/WebGL2RenderingContext.idl
M Source/WebCore/html/canvas/WebGLBuffer.cpp
M Source/WebCore/html/canvas/WebGLBuffer.h
M Source/WebCore/html/canvas/WebGLFramebuffer.cpp
M Source/WebCore/html/canvas/WebGLFramebuffer.h
M Source/WebCore/html/canvas/WebGLObject.h
M Source/WebCore/html/canvas/WebGLProgram.cpp
M Source/WebCore/html/canvas/WebGLProgram.h
M Source/WebCore/html/canvas/WebGLQuery.cpp
M Source/WebCore/html/canvas/WebGLQuery.h
M Source/WebCore/html/canvas/WebGLRenderbuffer.cpp
M Source/WebCore/html/canvas/WebGLRenderbuffer.h
M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
M Source/WebCore/html/canvas/WebGLRenderingContextBase.h
M Source/WebCore/html/canvas/WebGLRenderingContextBase.idl
M Source/WebCore/html/canvas/WebGLSampler.cpp
M Source/WebCore/html/canvas/WebGLSampler.h
M Source/WebCore/html/canvas/WebGLShader.cpp
M Source/WebCore/html/canvas/WebGLShader.h
M Source/WebCore/html/canvas/WebGLSync.cpp
M Source/WebCore/html/canvas/WebGLSync.h
M Source/WebCore/html/canvas/WebGLTexture.cpp
M Source/WebCore/html/canvas/WebGLTexture.h
M Source/WebCore/html/canvas/WebGLTransformFeedback.cpp
M Source/WebCore/html/canvas/WebGLTransformFeedback.h
M Source/WebCore/html/canvas/WebGLVertexArrayObject.cpp
M Source/WebCore/html/canvas/WebGLVertexArrayObject.h
M Source/WebCore/html/canvas/WebGLVertexArrayObjectBase.cpp
M Source/WebCore/html/canvas/WebGLVertexArrayObjectBase.h
M Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.cpp
M Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.h
Log Message:
-----------
Cherry-pick 308490@main (60b1bee24bc4).
https://bugs.webkit.org/show_bug.cgi?id=282031
WebGL CTS context loss tests fail due to create* not being infallible
https://bugs.webkit.org/show_bug.cgi?id=282031
rdar://138542123
Reviewed by Dan Glastonbury.
WebGL specs were change so that create* functions are mostly infallible,
always returning an object even if the context is lost.
Add constructors for creating the objects with lost context.
* LayoutTests/TestExpectations:
* LayoutTests/fast/canvas/webgl/context-lost.html: Removed.
Remove the old variant of the current CTS test, it is contradicting
the current CTS.
* Source/WebCore/html/canvas/OESVertexArrayObject.cpp:
(WebCore::OESVertexArrayObject::createVertexArrayOES):
* Source/WebCore/html/canvas/OESVertexArrayObject.h:
* Source/WebCore/html/canvas/OESVertexArrayObject.idl:
* Source/WebCore/html/canvas/WebGL2RenderingContext.cpp:
(WebCore::WebGL2RenderingContext::createQuery):
(WebCore::WebGL2RenderingContext::createSampler):
(WebCore::WebGL2RenderingContext::fenceSync):
(WebCore::WebGL2RenderingContext::createTransformFeedback):
(WebCore::WebGL2RenderingContext::createVertexArray):
* Source/WebCore/html/canvas/WebGL2RenderingContext.h:
* Source/WebCore/html/canvas/WebGL2RenderingContext.idl:
* Source/WebCore/html/canvas/WebGLBuffer.cpp:
(WebCore::WebGLBuffer::create):
(WebCore::WebGLBuffer::createLost):
* Source/WebCore/html/canvas/WebGLBuffer.h:
* Source/WebCore/html/canvas/WebGLFramebuffer.cpp:
(WebCore::WebGLFramebuffer::createLost):
(WebCore::WebGLFramebuffer::create):
(WebCore::WebGLFramebuffer::WebGLFramebuffer):
* Source/WebCore/html/canvas/WebGLFramebuffer.h:
* Source/WebCore/html/canvas/WebGLObject.h:
* Source/WebCore/html/canvas/WebGLProgram.cpp:
(WebCore::WebGLProgram::createLost):
(WebCore::WebGLProgram::create):
(WebCore::WebGLProgram::WebGLProgram):
* Source/WebCore/html/canvas/WebGLProgram.h:
* Source/WebCore/html/canvas/WebGLQuery.cpp:
(WebCore::WebGLQuery::createLost):
(WebCore::WebGLQuery::create):
* Source/WebCore/html/canvas/WebGLQuery.h:
* Source/WebCore/html/canvas/WebGLRenderbuffer.cpp:
(WebCore::WebGLRenderbuffer::createLost):
(WebCore::WebGLRenderbuffer::create):
* Source/WebCore/html/canvas/WebGLRenderbuffer.h:
* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::createBuffer):
(WebCore::WebGLRenderingContextBase::createFramebuffer):
(WebCore::WebGLRenderingContextBase::createTexture):
(WebCore::WebGLRenderingContextBase::createProgram):
(WebCore::WebGLRenderingContextBase::createRenderbuffer):
(WebCore::WebGLRenderingContextBase::createShader):
* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:
* Source/WebCore/html/canvas/WebGLRenderingContextBase.idl:
* Source/WebCore/html/canvas/WebGLSampler.cpp:
(WebCore::WebGLSampler::createLost):
(WebCore::WebGLSampler::create):
* Source/WebCore/html/canvas/WebGLSampler.h:
* Source/WebCore/html/canvas/WebGLShader.cpp:
(WebCore::WebGLShader::createLost):
(WebCore::WebGLShader::create):
(WebCore::WebGLShader::WebGLShader):
* Source/WebCore/html/canvas/WebGLShader.h:
* Source/WebCore/html/canvas/WebGLSync.cpp:
(WebCore::WebGLSync::createLost):
(WebCore::WebGLSync::create):
(WebCore::WebGLSync::WebGLSync):
(WebCore::WebGLSync::scheduleAllowCacheUpdate):
* Source/WebCore/html/canvas/WebGLSync.h:
* Source/WebCore/html/canvas/WebGLTexture.cpp:
(WebCore::WebGLTexture::createLost):
(WebCore::WebGLTexture::create):
* Source/WebCore/html/canvas/WebGLTexture.h:
* Source/WebCore/html/canvas/WebGLTransformFeedback.cpp:
(WebCore::WebGLTransformFeedback::createLost):
(WebCore::WebGLTransformFeedback::create):
* Source/WebCore/html/canvas/WebGLTransformFeedback.h:
* Source/WebCore/html/canvas/WebGLVertexArrayObject.cpp:
(WebCore::WebGLVertexArrayObject::createLost):
(WebCore::WebGLVertexArrayObject::create):
* Source/WebCore/html/canvas/WebGLVertexArrayObject.h:
* Source/WebCore/html/canvas/WebGLVertexArrayObjectBase.cpp:
(WebCore::WebGLVertexArrayObjectBase::WebGLVertexArrayObjectBase):
* Source/WebCore/html/canvas/WebGLVertexArrayObjectBase.h:
* Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.cpp:
(WebCore::WebGLVertexArrayObjectOES::createLost):
(WebCore::WebGLVertexArrayObjectOES::createUser):
* Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.h:
Canonical link: https://commits.webkit.org/308490@main
Canonical link: https://commits.webkit.org/305877.947@webkitglib/2.52
Commit: 4acf78ceac157cc2b7c2698d57026617853a4502
https://github.com/WebKit/WebKit/commit/4acf78ceac157cc2b7c2698d57026617853a4502
Author: Ruthvik Konda <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
A
LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash-expected.txt
A
LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash.html
M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
Log Message:
-----------
Cherry-pick 309187@main (62d001fb2754).
https://bugs.webkit.org/show_bug.cgi?id=309828
OffscreenCanvas.transferToImageBitmap() crashes after navigation when WebGL
context is lost
https://bugs.webkit.org/show_bug.cgi?id=309828
rdar://171699663
Reviewed by Kimmo Kinnunen.
Add missing isContextLost() guard to
WebGLRenderingContextBase::transferToImageBuffer().
When an OffscreenCanvas with a WebGL context calls transferToImageBitmap()
after
navigation.navigate(), the document teardown calls stop() which force-loses
the
context and destroys the GraphicsContextGL. transferToImageBuffer() then
accesses
m_defaultFramebuffer->size() which dereferences the null graphicsContextGL
pointer.
Every other method that accesses m_defaultFramebuffer->size()
(drawingBufferWidth,
drawingBufferHeight, drawingBufferToPixelBuffer) already guards with
isContextLost().
transferToImageBuffer() was missing this guard since commit 163003d0cfa2
refactored
it to use m_defaultFramebuffer->size() directly.
Added layout test that creates a WebGL OffscreenCanvas, triggers
navigation, then
calls transferToImageBitmap(). Without the fix, the WebContent process
crashes during
document teardown. With the fix, the isContextLost() guard returns early
and the test
completes without crashing.
Test: fast/canvas/offscreen-webgl-transfer-after-navigation-crash.html
*
LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash-expected.txt:
Added.
*
LayoutTests/fast/canvas/offscreen-webgl-transfer-after-navigation-crash.html:
Added.
* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::transferToImageBuffer):
Canonical link: https://commits.webkit.org/309187@main
Canonical link: https://commits.webkit.org/305877.948@webkitglib/2.52
Commit: 58d7454e078ad59c6974e5dd60518ccb350dbe8d
https://github.com/WebKit/WebKit/commit/58d7454e078ad59c6974e5dd60518ccb350dbe8d
Author: Kimmo Kinnunen <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M LayoutTests/webgl/lose-context-after-context-lost-expected.txt
M LayoutTests/webgl/lose-context-after-context-lost.html
M Source/WebCore/html/canvas/WebGL2RenderingContext.idl
M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
M Source/WebCore/testing/Internals.cpp
M Source/WebCore/testing/Internals.h
M Source/WebCore/testing/Internals.idl
Log Message:
-----------
Cherry-pick 309401@main (bff80081bbf1).
https://bugs.webkit.org/show_bug.cgi?id=309777
REGRESSION(307450@main): WebGL: Crash resizing canvas after losing WebGL
context due to many contexts
https://bugs.webkit.org/show_bug.cgi?id=309777
rdar://172265758
Reviewed by Dan Glastonbury.
Avoid accessing WebGLDefaultFramebuffer::size() when context is lost,
in didUpdateCanvasSizeProperties(), transferToImageBuffer().
Prior fix (webkit.org/b/309777, 308389@main, 673b8d7495af) applied to
lost contexts that did not destroy the underlying context.
* LayoutTests/webgl/lose-context-after-context-lost-expected.txt:
* LayoutTests/webgl/lose-context-after-context-lost.html:
* Source/WebCore/html/canvas/WebGL2RenderingContext.idl:
* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::drawingBufferToPixelBuffer):
(WebCore::WebGLRenderingContextBase::transferToImageBuffer):
(WebCore::WebGLRenderingContextBase::didUpdateCanvasSizeProperties):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::simulateEventForWebGLContext):
(WebCore::Internals::requestedGPU):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
Canonical link: https://commits.webkit.org/309401@main
Canonical link: https://commits.webkit.org/305877.949@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/c388c0f804c9...58d7454e078a
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
