Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8e980f978de665f7960aab424b917f4ad89c316d
https://github.com/WebKit/WebKit/commit/8e980f978de665f7960aab424b917f4ad89c316d
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-16 (Sun, 16 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/cocoa/IOSurface.mm
Log Message:
-----------
IOSurface::convertToFormat leaks the completion callback and destination
surface when the accelerator fails
https://bugs.webkit.org/show_bug.cgi?id=319805
rdar://182688059
Reviewed by Mike Wyrzykowski.
If IOSurfaceAcceleratorTransformSurface() fails synchronously, the
heap-allocated completion WTF::Function and the released
destinationSurface raw pointer both leaked, since the completion
callback that would normally free them never fires. This was silent
in release builds because ASSERT_UNUSED compiles out the check.
Synchronous failure is observable rather than theoretical. The
accelerator validates the request and can reject it before queuing
anything, for surfaces below the hardware's minimum dimensions, for
unsupported format or option combinations, and when it cannot acquire
the resources needed to wire and map the surfaces. Log the error
instead of asserting, since none of those are programming errors on
our side.
Fix the leak by having the synchronous failure path invoke the same
completionCallback that the accelerator would have invoked
asynchronously, instead of duplicating its cleanup logic. Since that
shared callback previously ignored its IOReturn result and always
handed the (possibly untransformed) destination surface to the
caller, also fix it to pass nullptr on failure, matching the failure
contract already used earlier in the function for accelerator
creation and destination surface creation failures. This corrects
both the synchronous failure this bug is about and any true
asynchronous transform failure reported later by the OS, which can
leave the destination surface only partially written.
Also stop ignoring a null return from
IOSurfaceAcceleratorGetRunLoopSource(). Adding a null source to the
main run loop is invalid, and because the accelerator was cached in a
static before it was known to be usable, every later conversion would
have issued a transform whose completion could never be delivered,
leaking the WTF::Function and an entire destination surface each time
for the life of the process. Only cache the accelerator once it has a
run loop source.
* Source/WebCore/platform/graphics/cocoa/IOSurface.mm:
(WebCore::IOSurface::convertToFormat):
Canonical link: https://commits.webkit.org/319262@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
