Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f2f5e1dff4dd0ccea5792e7395dce1dce3281db1
https://github.com/WebKit/WebKit/commit/f2f5e1dff4dd0ccea5792e7395dce1dce3281db1
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-06 (Sun, 06 Sep 2026)
Changed paths:
A
LayoutTests/fast/canvas/canvas-transient-allocation-failure-recovery-expected.txt
A LayoutTests/fast/canvas/canvas-transient-allocation-failure-recovery.html
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
Log Message:
-----------
Canvas 2D context is permanently poisoned after a transient backing-store
allocation failure
https://bugs.webkit.org/show_bug.cgi?id=323555
rdar://186799597
Reviewed by Gerald Squelart.
CanvasRenderingContext2DBase::buffer() set m_hasCreatedImageBuffer to true
before checking whether allocateImageBuffer() actually succeeded. When
allocation failed transiently (memory pressure, area limit, no GPU buffer,
IPC failure), the flag was left true while m_buffer stayed null. Every
later buffer() call then hit the early `if (m_hasCreatedImageBuffer) return
m_buffer;` and returned null without ever retrying, so the context was
permanently dead until an actual canvas resize cleared the flag in
didUpdateCanvasSizeProperties() -- a plain reset() or `ctx.width =
ctx.width` self-assign does not.
The stale flag also made two readers wrong: isSurfaceBufferTransparentBlack()
returned false (so HTMLCanvasElement::paint() drew a nonexistent surface
instead of filling transparent black), and baseTransform()'s
ASSERT(m_hasCreatedImageBuffer) passed with false confidence before
dereferencing buffer()->baseTransform() -- a release-mode null deref
reachable via fullCanvasCompositedDrawImage() ->
calculateCompositingBufferRect(), which calls baseTransform() before any
drawing-context null check.
Set m_hasCreatedImageBuffer only after allocation succeeds, so a transient
failure leaves the context able to retry on the next draw.
Test: fast/canvas/canvas-transient-allocation-failure-recovery.html
*
LayoutTests/fast/canvas/canvas-transient-allocation-failure-recovery-expected.txt:
Added.
* LayoutTests/fast/canvas/canvas-transient-allocation-failure-recovery.html:
Added.
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::buffer const):
Canonical link: https://commits.webkit.org/320605@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
