Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e1d90aba37f5ef0b38d954bf715feebb2cae92d5
https://github.com/WebKit/WebKit/commit/e1d90aba37f5ef0b38d954bf715feebb2cae92d5
Author: David Kilzer <[email protected]>
Date: 2026-08-15 (Sat, 15 Aug 2026)
Changed paths:
A LayoutTests/fast/images/destroy-decoded-data-accounting-expected.txt
A LayoutTests/fast/images/destroy-decoded-data-accounting.html
A
LayoutTests/http/tests/images/destroy-decoded-data-accounting-incomplete-frame-expected.txt
A
LayoutTests/http/tests/images/destroy-decoded-data-accounting-incomplete-frame.html
M LayoutTests/http/tests/resources/load-and-stall.py
M Source/WebCore/platform/graphics/BitmapImage.cpp
M Source/WebCore/platform/graphics/BitmapImageSource.cpp
M Source/WebCore/platform/graphics/BitmapImageSource.h
M Source/WebCore/platform/graphics/ImageFrame.h
M Source/WebCore/platform/graphics/ImageSource.cpp
M Source/WebCore/platform/graphics/ImageSource.h
Log Message:
-----------
[WebCore] ASSERT(m_decodedSize >= decodedSize) in
BitmapImageSource::decodedSizeReset()
<https://bugs.webkit.org/show_bug.cgi?id=321735>
<rdar://184788659>
Reviewed by Said Abou-Hallawa.
BitmapImageSource tracks its decoded size by adding a frame's
sizeInBytes() when its NativeImage is cached and subtracting the same
measurement when the frame is cleared, both read live from
NativeImage::sizeInBytes(). When drawing goes through the GPU process,
RemoteResourceCacheProxy::recordNativeImageUse() replaces the platform
image with a memory-saving ShareableBitmap of a different size, so the
size subtracted at clear time no longer matches the size added at
cache time. When the replacement is larger, m_decodedSize underflows
and decodedSizeReset() asserts.
Route BitmapImage::draw() through a new ImageSource::drawNativeImage()
virtual. BitmapImageSource overrides it to measure the NativeImage
around the draw and fold the difference into its decoded-size
accounting; the replacement happens synchronously as the draw is
recorded, so the running total tracks the real size and matches what
the frame subtracts when it is cleared. The base implementation just
draws.
Fold the difference only while the current frame still owns the drawn
NativeImage. BitmapImage::draw() reads the frame's orientation and
headroom after obtaining the image, and for a still-incomplete
(progressively-loading) frame that clears the frame and has already
dropped its size from m_decodedSize, leaving the NativeImage alive only
on the caller's stack. Folding then would corrupt the total; while the
frame still owns the image, m_decodedSize includes its pre-draw size,
so the adjustment stays balanced against the eventual clear.
Tests: fast/images/destroy-decoded-data-accounting.html
http/tests/images/destroy-decoded-data-accounting-incomplete-frame.html
* LayoutTests/fast/images/destroy-decoded-data-accounting-expected.txt: Add.
* LayoutTests/fast/images/destroy-decoded-data-accounting.html: Add.
*
LayoutTests/http/tests/images/destroy-decoded-data-accounting-incomplete-frame-expected.txt:
Add.
*
LayoutTests/http/tests/images/destroy-decoded-data-accounting-incomplete-frame.html:
Add.
* LayoutTests/http/tests/resources/load-and-stall.py:
- Document that a test repeated in one web process may need a
cache-busting query parameter to avoid stalling its own later loads.
* Source/WebCore/platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::draw):
* Source/WebCore/platform/graphics/BitmapImageSource.cpp:
(WebCore::BitmapImageSource::drawNativeImage): Add.
* Source/WebCore/platform/graphics/BitmapImageSource.h:
* Source/WebCore/platform/graphics/ImageFrame.h:
(WebCore::ImageFrame::hasNativeImage): Add.
* Source/WebCore/platform/graphics/ImageSource.cpp:
(WebCore::ImageSource::drawNativeImage): Add.
* Source/WebCore/platform/graphics/ImageSource.h:
Canonical link: https://commits.webkit.org/319239@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
