Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: e4191f226738cded013826d68b48e9bf89ec7814
https://github.com/WebKit/WebKit/commit/e4191f226738cded013826d68b48e9bf89ec7814
Author: Justin Michaud <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M LayoutTests/fast/images/animated-image-mp4-crash.html
A LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt
A LayoutTests/fast/images/apng-acTL-frame-count-overflow.html
A LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt
A LayoutTests/fast/images/apng-acTL-zero-frame-count.html
A
LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt
A LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html
A LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png
A
LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png
A
LayoutTests/fast/images/resources/apng-frame-cache-eviction.png
A
LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt
A LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html
A LayoutTests/http/tests/images/resources/ico-png-subimage.ico
M LayoutTests/platform/ios/TestExpectations
M LayoutTests/platform/mac/TestExpectations
M Source/WebCore/platform/graphics/ImageBackingStore.h
M Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
M Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
M Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp
M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
M Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
M Source/WebCore/testing/Internals.cpp
M Source/WebCore/testing/Internals.h
M
Source/WebCore/testing/Internals.idl
M Tools/TestWebKitAPI/PlatformGTK.cmake
M
Tools/TestWebKitAPI/PlatformWPE.cmake
A Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp
Log Message:
-----------
Cherry-pick 320102@main (24545f4fcbd7).
https://bugs.webkit.org/show_bug.cgi?id=321756
[non-cocoa][fuzz] Frame cache evicted or unparsed frames dereferenced
https://bugs.webkit.org/show_bug.cgi?id=321756
Reviewed by Claudio Saavedra.
Add some helpers to test the various image decoders.
Fix:
- PNGImageDecoder::readChunks() stored the acTL frame count before
validating
it, so a malformed APNG could advertise up to 2^32 - 1 frames through
frameCount() while the frame buffer cache held a single entry.
- PNGImageDecoder::initFrameBuffer() and frameComplete(), and the same
compositing logic in GIFImageDecoder::frameComplete(), read the previous
frame's backing store; a frame evicted from the frame
cache has none, so
null-check it first.
-
JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded() built an end iterator
from clearBeforeFrame without clamping it to the cache size.
- WEBPImageDecoder::frameBufferAtIndex() blindly indexed the cache after
decode(), but decode() leaves the cache untouched when it bails out early.
- ICOImageDecoder::decodeAtIndex() dereferenced the embedded PNG
sub-decoder's
firstFrameBuffer(), which can be null
* LayoutTests/fast/images/animated-image-mp4-crash.html:
* LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt:
Added.
* LayoutTests/fast/images/apng-acTL-frame-count-overflow.html: Added.
* LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt: Added.
* LayoutTests/fast/images/apng-acTL-zero-frame-count.html: Added.
*
LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt:
Added.
*
LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html: Added.
*
LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png: Added.
* LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png: Added.
* LayoutTests/fast/images/resources/apng-frame-cache-eviction.png: Added.
*
LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt:
Added.
* LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html:
Added.
* LayoutTests/http/tests/images/resources/ico-png-subimage.ico: Added.
* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:
(WebCore::GIFImageDecoder::frameComplete):
* Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:
(WebCore::ICOImageDecoder::decodeAtIndex):
* Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp:
(WebCore::JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded):
*
Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp:
(WebCore::PNGImageDecoder::frameBufferAtIndex):
(WebCore::PNGImageDecoder::readChunks):
(WebCore::PNGImageDecoder::initFrameBuffer):
(WebCore::PNGImageDecoder::frameComplete):
* Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp:
(WebCore::WEBPImageDecoder::frameBufferAtIndex):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::forceDecodeImageFrameAtIndex):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
* Tools/TestWebKitAPI/PlatformGTK.cmake:
* Tools/TestWebKitAPI/PlatformWPE.cmake:
* Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp: Added.
(TestWebKitAPI::append32):
(TestWebKitAPI::crc32For):
(TestWebKitAPI::appendChunk):
(TestWebKitAPI::redScanlines):
(TestWebKitAPI::storedZlibStream):
(TestWebKitAPI::makeAnimatedPNG):
(TestWebKitAPI::makeTwoFrameAPNG):
(TestWebKitAPI::createDecoder):
(TestWebKitAPI::TEST(ImageDecoder,
APNGRejectedFrameCountIsNotReported)):
(TestWebKitAPI::TEST(ImageDecoder, APNGZeroFrameCountStillDecodesDefaultImage)):
(TestWebKitAPI::TEST(ImageDecoder, APNGValidFrameCountIsReported)):
(TestWebKitAPI::TEST(ImageDecoder, ClearFrameBufferCacheThenDecodeAgain)):
(TestWebKitAPI::TEST(ImageDecoder, FrameIndexPastEndIsHandled)):
(TestWebKitAPI::TEST(ImageDecoder, PartialDataThenFullData)):
(TestWebKitAPI::makeICOWithPNGSubImage):
(TestWebKitAPI::TEST(ImageDecoder, ICOWithPartiallyReceivedPNGSubImage)):
* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/mac/TestExpectations:
Canonical link: https://commits.webkit.org/320102@main
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dr4Z8y2CJ8&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE2NkB3ZWJraXRnbGliLzIuNTQ=&emid=2090655d-8ba9-4ef5-a013-73374da7b77d&c=11
Commit:
678106fbbb24ede93a04fbdd3d2acb1ddad786b8
https://github.com/WebKit/WebKit/commit/678106fbbb24ede93a04fbdd3d2acb1ddad786b8
Author: Justin Michaud <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
A
LayoutTests/fast/images/apng-icc-frame-right-half-expected.html
A LayoutTests/fast/images/apng-icc-frame-right-half.html
A LayoutTests/fast/images/resources/apng-icc-frame-right-half-reference.png
A LayoutTests/fast/images/resources/apng-icc-frame-right-half.png
Log Message:
-----------
Cherry-pick 320038@main (2668e2d7adfe).
https://bugs.webkit.org/show_bug.cgi?id=321751
[non-cocoa][fuzz] OOB write in APNG ICC conversion
https://bugs.webkit.org/show_bug.cgi?id=321751
Reviewed by Adrian Perez de Castro.
The reporter fixed this upstream, just add a test.
Canonical
link:
https://flagged.apple.com:443/proxy?t2=DZ0c3h0vS2&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIwMDM4QG1haW4=&emid=2090655d-8ba9-4ef5-a013-73374da7b77d&c=11
Canonical
link:
https://flagged.apple.com:443/proxy?t2=DG1y2b5rV0&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE2N0B3ZWJraXRnbGliLzIuNTQ=&emid=2090655d-8ba9-4ef5-a013-73374da7b77d&c=11
Commit: 2cb2a0dc47b496abadd9de8c826e7167a6a7d3f3
https://github.com/WebKit/WebKit/commit/2cb2a0dc47b496abadd9de8c826e7167a6a7d3f3
Author:
Mike Gorse <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Source/WebKit/SourcesGTK.txt
M Source/WebKit/SourcesWPE.txt
M
Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/NonCompositedFrameRenderer.cpp
Log Message:
-----------
Cherry-pick 319999@main (c2d659a809a2).
https://bugs.webkit.org/show_bug.cgi?id=322108
Build failure: Xlib defines causing conflicts
https://bugs.webkit.org/show_bug.cgi?id=322108
Reviewed by
Adrian Perez de Castro.
Epoxy.h can pull in xlib.h, which pollutes the namespace and causes problems
later with unified sources.
* Source/WebKit/SourcesGTK.txt:
* Source/WebKit/SourcesWPE.txt:
*
Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/NonCompositedFrameRenderer.cpp:
(WebKit::NonCompositedFrameRenderer::foreachRegionInDamageHistoryForTesting
const):
Canonical link: https://commits.webkit.org/319999@main
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dq0v2a1IF0&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE2OEB3ZWJraXRnbGliLzIuNTQ=&emid=2090655d-8ba9-4ef5-a013-73374da7b77d&c=11
Commit: 3d809b0eb8e1d384c9a8ab20bf4140e9a261e82e
https://github.com/WebKit/WebKit/commit/3d809b0eb8e1d384c9a8ab20bf4140e9a261e82e
Author: Carlos Garcia Campos <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/skia/SkiaSerializedImageBuffer.cpp
M Source/WebCore/platform/graphics/skia/SkiaSerializedImageBuffer.h
Log Message:
-----------
Cherry-pick 319660@main
(1feb6ac19b06).
https://bugs.webkit.org/show_bug.cgi?id=322349
[Skia] Do not transfer accelerated ImageBuffer to a different thread
https://bugs.webkit.org/show_bug.cgi?id=322349
Reviewed by Nikolas Zimmermann.
The
SkSurface created by an accelerated ImageBuffer is expected to be
released in the same thread it was created so that GL resources are
freed by the right GrContext. For accelerated ImageBuffer we take an
image snapshot and save all
ImageBuffer parameters required to create
a new one in the destination thread to copy the image snapshot into.
* Source/WebCore/platform/graphics/skia/SkiaSerializedImageBuffer.cpp:
(WebCore::SkiaSerializedImageBuffer::SkiaSerializedImageBuffer):
(WebCore::SkiaSerializedImageBuffer::sinkIntoImageBuffer):
(WebCore::SkiaSerializedImageBuffer::memoryCost
const):
* Source/WebCore/platform/graphics/skia/SkiaSerializedImageBuffer.h:
Canonical
link:
https://flagged.apple.com:443/proxy?t2=dv3v2w9oW9&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE5NjYwQG1haW4=&emid=2090655d-8ba9-4ef5-a013-73374da7b77d&c=11
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dq4m3J9Vl8&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE2OUB3ZWJraXRnbGliLzIuNTQ=&emid=2090655d-8ba9-4ef5-a013-73374da7b77d&c=11
Compare: https://github.com/WebKit/WebKit/compare/23b4c9a60608...3d809b0eb8e1
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
