Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 1603d30438c2628ceb6b413201a1c26b6e5cc192
      
https://github.com/WebKit/WebKit/commit/1603d30438c2628ceb6b413201a1c26b6e5cc192
  Author: Matt Woodrow <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M Source/WebKit/GPUProcess/GPUProcess.cpp
    M Source/WebKit/GPUProcess/graphics/RemoteSnapshot.cpp
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.h
    M Source/WebKit/WebProcess/WebPage/WebPage.messages.in
    M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm

  Log Message:
  -----------
  Crash in RemoteSnapshot::applyFrame accessing null display list.
https://bugs.webkit.org/show_bug.cgi?id=322072
<rdar://182787176>

Reviewed by Kimmo Kinnunen.

WebPageProxy::takeSnapshot can intentionally use an empty size for the snapshot
(when _setUsesContentsRect is TRUE), for the WebProcess to resolve the actual
size.  Sending this empty size to the GPUProcess fails to allocate a buffer, and
crashes.

Return the resolved size from the WebProcess, and use that to send to the
GPUProcess instead.

Tests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm

* Source/WebKit/GPUProcess/GPUProcess.cpp:
(WebKit::GPUProcess::sinkCompletedSnapshotToPDF):
(WebKit::GPUProcess::sinkCompletedSnapshotToBitmap):
* Source/WebKit/GPUProcess/graphics/RemoteSnapshot.cpp:
(WebKit::RemoteSnapshot::drawToBitmap):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::takeSnapshot):
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::takeRemoteSnapshot):
* Source/WebKit/WebProcess/WebPage/WebPage.h:
* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm:
(TestWebKitAPI::TEST(WKWebView, RemoteSnapshotWithContentsRect)):

Canonical link: https://commits.webkit.org/319479@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to