Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 2dd100cb7283ad396c17c7f288a574942f880fd3
https://github.com/WebKit/WebKit/commit/2dd100cb7283ad396c17c7f288a574942f880fd3
Author: Yulun Wu <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure-expected.txt
A LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure.html
M Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp
M
Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.cpp
Log Message:
-----------
Cherry-pick [email protected] (47dab0040d33).
https://bugs.webkit.org/show_bug.cgi?id=318455
putPixelBuffer() and getPixelBuffer() are not applicable for LayerBacking()
https://bugs.webkit.org/show_bug.cgi?id=318455
rdar://177958824
Reviewed by Said Abou-Hallawa.
Per 264004@main, putPixelBuffer() and getPixelBuffer() are not applicable
for LayerBacking. This PR enforces that comment by adding a MESSAGE_CHECK().
This PR also updates the no-op override to zero-fill its
destination instead of leaving it uninitialized to fail gracefully
on release builds while still hitting the assert in debug.
* LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure-expected.txt:
Added.
* LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure.html: Added.
* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp:
(WebKit::RemoteImageBuffer::getPixelBuffer):
(WebKit::RemoteImageBuffer::putPixelBuffer):
*
Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.cpp:
(WebKit::ImageBufferShareableMappedIOSurfaceBitmapBackend::getPixelBuffer):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1156@webkitglib/2.52
Commit: 5a72712dbe0ec16e036c4f30dda956b1712ff48a
https://github.com/WebKit/WebKit/commit/5a72712dbe0ec16e036c4f30dda956b1712ff48a
Author: Yijia Huang <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/stress/arith-abs-checked-input-range.js
M Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (f778c76c61d1).
https://bugs.webkit.org/show_bug.cgi?id=317611
[JSC] Pin upstream checks that DFG IRO range proofs rely on
rdar://179027979
https://bugs.webkit.org/show_bug.cgi?id=317611
Reviewed by Keith Miller.
DFGIntegerRangeOptimizationPhase (IRO) flips checked arithmetic to
Arith::Unchecked using range proofs derived from other checked ops in
the graph, but doesn't record that dependency. DFG DCE can then remove
those upstream checks (when their values are otherwise unread), making
IRO's earlier mutations unsound at runtime.
* rangeFor() now returns a RangeBound { value, proof } per axis,
where proof points to the relationship that produced the tight
bound (one per axis; ties resolved by first encountered).
* pinRangeBounds(...) is a variadic helper that sets NodeMustGenerate
on the producers behind each given bound's proof. Every site that
flips a checked op to Arith::Unchecked calls it with only the
bounds the proof actually consulted.
Test: JSTests/stress/arith-abs-checked-input-range.js
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1157@webkitglib/2.52
Commit: 2518b601960e0cfff56a387c9dc781643eb39456
https://github.com/WebKit/WebKit/commit/2518b601960e0cfff56a387c9dc781643eb39456
Author: Youenn Fablet <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash-expected.txt
A
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash.html
M Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp
Log Message:
-----------
Cherry-pick [email protected] (50232798d951).
https://bugs.webkit.org/show_bug.cgi?id=317611
Race on RemoteVideoDecoderCallbacks::m_timestampToDuration leads to
use-after-free
rdar://177096608
Reviewed by Jean-Yves Avenard.
RemoteVideoDecoderCallbacks::addDuration is called from the JS thread that
invoked VideoDecoder.decode.
RemoteVideoDecoderCallbacks::notifyDecodingResult is called from the
LibWebRTCCodecs work queue.
Both mutate m_timestampToDuration so we need to add a lock to ensure
synchronization.
We also make m_isClosed atomic on both the decoder and encoder callback
objects as it is written in a thread and read in another.
Patch mostly written by Simon Lewis.
*
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash-expected.txt:
Added.
*
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash.html:
Added.
* Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp:
(WebKit::RemoteVideoDecoderCallbacks::addDuration):
(WebKit::RemoteVideoDecoderCallbacks::takeDuration):
(WebKit::RemoteVideoDecoderCallbacks::notifyDecodingResult):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1158@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/c88db38e4dde...2518b601960e
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
