Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b7416f7b376405f643dade62ac637af3a4c1e5d1
https://github.com/WebKit/WebKit/commit/b7416f7b376405f643dade62ac637af3a4c1e5d1
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
M Source/WebCore/Modules/system-preview/ARKitBadgeSystemImage.h
M Source/WebCore/Modules/system-preview/ARKitBadgeSystemImage.mm
M Source/WebKit/GPUProcess/graphics/RemoteGraphicsContext.cpp
M Source/WebKit/GPUProcess/graphics/RemoteGraphicsContext.h
M Source/WebKit/GPUProcess/graphics/RemoteGraphicsContext.messages.in
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextProxy.cpp
Log Message:
-----------
REGRESSION(322274@main): [ iOS ] system-preview/svg-image.html is a constant
crash (CRASH)
https://bugs.webkit.org/show_bug.cgi?id=326522
rdar://189316935
Reviewed by Mike Wyrzykowski.
The problem is in SystemImage, which creates a NativeImage from the SVGImage in
two separate places. While SVGImageCache existed, it cached the NativeImage, so
both call sites got the same one. Without the cache, each call site creates its
own NativeImage.
Before sending the DrawSystemImage message to the GPU process, we first share
the NativeImage with it. We then send the RenderingResourceIdentifier of the
NativeImage. The sharing identifier differs from the drawing identifier. The GPU
process therefore can't find the NativeImage in its cache and terminates the
WebContent process.
The fix is to cache the NativeImage in SystemImage, which does not need to hold
a pointer to the Image. As with DrawNativeImage, the NativeImage is shared
first.
Then its RenderingResourceIdentifier is sent in a new message,
DrawBadgeSystemImage.
* Source/WebCore/Modules/system-preview/ARKitBadgeSystemImage.h:
* Source/WebCore/Modules/system-preview/ARKitBadgeSystemImage.mm:
(WebCore::ARKitBadgeSystemImage::create):
(WebCore::ARKitBadgeSystemImage::createWithoutImage):
(WebCore::ARKitBadgeSystemImage::draw const):
(WebCore::ARKitBadgeSystemImage::imageIdentifier const): Deleted.
* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContext.cpp:
(WebKit::RemoteGraphicsContext::drawBadgeSystemImage):
(WebKit::RemoteGraphicsContext::drawSystemImage):
* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContext.h:
* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContext.messages.in:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextProxy.cpp:
(WebKit::RemoteGraphicsContextProxy::drawSystemImage):
Canonical link: https://commits.webkit.org/323123@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
