Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 14b236e9bd787f31feb7277a58882c2831dca14b
https://github.com/WebKit/WebKit/commit/14b236e9bd787f31feb7277a58882c2831dca14b
Author: Yulun Wu <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure-expected.txt
A LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure.html
M Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp
M
Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.cpp
Log Message:
-----------
Cherry-pick [email protected] (47dab0040d33).
https://bugs.webkit.org/show_bug.cgi?id=318455
putPixelBuffer() and getPixelBuffer() are not applicable for LayerBacking()
https://bugs.webkit.org/show_bug.cgi?id=318455
rdar://177958824
Reviewed by Said Abou-Hallawa.
Per
264004@main, putPixelBuffer() and getPixelBuffer() are not applicable
for LayerBacking. This PR enforces that comment by adding a MESSAGE_CHECK().
This PR also updates the no-op override to zero-fill its
destination instead of leaving it uninitialized to fail gracefully
on release builds while still hitting the assert in debug.
* LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure-expected.txt:
Added.
* LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure.html: Added.
* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp:
(WebKit::RemoteImageBuffer::getPixelBuffer):
(WebKit::RemoteImageBuffer::putPixelBuffer):
*
Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.cpp:
(WebKit::ImageBufferShareableMappedIOSurfaceBitmapBackend::getPixelBuffer):
Identifier: [email protected]
Canonical
link:
https://flagged.apple.com:443/proxy?t2=Do3e3S3Iv1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIxNEB3ZWJraXRnbGliLzIuNTQ=&emid=980a3b45-8ac9-4225-8f39-ad11aae908fe&c=11
Commit:
d049c1c628062ff902118a355ae63491c327b86f
https://github.com/WebKit/WebKit/commit/d049c1c628062ff902118a355ae63491c327b86f
Author: Yijia Huang <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/stress/arith-abs-checked-input-range.js
M Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (f778c76c61d1).
https://bugs.webkit.org/show_bug.cgi?id=317611
[JSC] Pin upstream checks that DFG IRO range proofs rely on
rdar://179027979
https://bugs.webkit.org/show_bug.cgi?id=317611
Reviewed by Keith Miller.
DFGIntegerRangeOptimizationPhase (IRO) flips checked arithmetic to
Arith::Unchecked using range proofs derived
from
other checked ops in
the graph, but doesn't record that dependency. DFG DCE can then remove
those upstream checks (when their values are otherwise unread), making
IRO's earlier
mutations unsound at runtime.
* rangeFor() now returns a RangeBound { value, proof } per axis,
where proof points to the relationship that produced the tight
bound (one per axis; ties resolved by first encountered).
* pinRangeBounds(...) is a variadic helper that sets NodeMustGenerate
on the producers behind each given bound's proof. Every site that
flips a checked op to Arith::Unchecked calls it with only the
bounds the proof actually consulted.
Test: JSTests/stress/arith-abs-checked-input-range.js
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dy6a5J3Zd2&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIxNUB3ZWJraXRnbGliLzIuNTQ=&emid=980a3b45-8ac9-4225-8f39-ad11aae908fe&c=11
Commit: ec2f180698e19f44a79be4c0c813b5d9ef9bfb72
https://github.com/WebKit/WebKit/commit/ec2f180698e19f44a79be4c0c813b5d9ef9bfb72
Author: Youenn Fablet <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash-expected.txt
A
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash.html
M Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp
Log Message:
-----------
Cherry-pick [email protected] (50232798d951).
https://bugs.webkit.org/show_bug.cgi?id=317611
Race on RemoteVideoDecoderCallbacks::m_timestampToDuration leads to
use-after-free
rdar://177096608
Reviewed by Jean-Yves Avenard.
RemoteVideoDecoderCallbacks::addDuration is called from the JS thread that
invoked VideoDecoder.decode.
RemoteVideoDecoderCallbacks::notifyDecodingResult is called from the
LibWebRTCCodecs
work queue.
Both mutate m_timestampToDuration so we need to add a lock to ensure
synchronization.
We also make m_isClosed atomic
on both the decoder and encoder callback objects as it is written in a thread
and read in another.
Patch mostly written by Simon Lewis.
*
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash-expected.txt:
Added.
*
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash.html:
Added.
* Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp:
(WebKit::RemoteVideoDecoderCallbacks::addDuration):
(WebKit::RemoteVideoDecoderCallbacks::takeDuration):
(WebKit::RemoteVideoDecoderCallbacks::notifyDecodingResult):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DX0C3o0On9&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIxNkB3ZWJraXRnbGliLzIuNTQ=&emid=980a3b45-8ac9-4225-8f39-ad11aae908fe&c=11
Compare:
https://github.com/WebKit/WebKit/compare/130cbb0bb5dc...ec2f180698e1
To unsubscribe from these emails, change your notification settings
at https://github.com/WebKit/WebKit/settings/notifications
