Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e01947d450586c9a07ef7674b348f682ccccc698
https://github.com/WebKit/WebKit/commit/e01947d450586c9a07ef7674b348f682ccccc698
Author: Matt Woodrow <[email protected]>
Date: 2026-09-24 (Thu, 24 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/post-message-over-message-port-with-transfers-stays-in-order-expected.txt
A
LayoutTests/http/tests/site-isolation/post-message-over-message-port-with-transfers-stays-in-order.html
A
LayoutTests/http/tests/site-isolation/post-message-with-image-bitmap-stays-in-order-across-windows-expected.txt
A
LayoutTests/http/tests/site-isolation/post-message-with-image-bitmap-stays-in-order-across-windows.html
A
LayoutTests/http/tests/site-isolation/resources/record-message-order-across-windows.html
A LayoutTests/http/tests/site-isolation/resources/record-message-order.html
A
LayoutTests/http/tests/site-isolation/resources/relay-message-order-to-opener-frame.html
M Source/WebCore/platform/graphics/ImageBufferTransferIdentifier.h
M Source/WebKit/GPUProcess/GPUProcess.cpp
M Source/WebKit/GPUProcess/GPUProcess.h
M Source/WebKit/GPUProcess/GPUProcess.messages.in
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/Scripts/webkit/messages.py
M Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp
M Source/WebKit/Shared/ProcessQualified.serialization.in
M Source/WebKit/Shared/WTFArgumentCoders.serialization.in
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.cpp
M Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
M Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h
Log Message:
-----------
[Site Isolation] A message posted to a cross-site frame that transfers an
ImageBitmap can arrive after later messages
https://bugs.webkit.org/show_bug.cgi?id=325099
rdar://problem/188253511
Reviewed by Kimmo Kinnunen.
A message that transfers an ImageBitmap to a cross-site frame was held back in
the UI process, or for a MessagePort in the network process, until the GPU
process had handed the buffer over to the recipient. The sender deposits the
buffer on its own rendering backend's work queue and the recipient claims it on
its own, so without that the claim could overtake the deposit. Anything posted
after it was sent straight on, including messages to other windows that share
the recipient's event loop, and arrived first.
The sender now waits for its rendering backend to deposit the buffer, and the
GPU process replies with the identifier to claim it by. The broker still hands
ownership of the buffer to the recipient, without waiting, so that it outlives
the sender.
An alternative approach of wait-free sending, and instead blocking on the
receiving RemoteRenderingBackend wasn't taken, since I don't think the added
complexity (and opportunity for compromised sending processes to deny service to
the receiver) is worth it at the point.
Tests:
http/tests/site-isolation/post-message-over-message-port-with-transfers-stays-in-order.html
http/tests/site-isolation/post-message-with-image-bitmap-stays-in-order-across-windows.html
*
LayoutTests/http/tests/site-isolation/post-message-over-message-port-with-transfers-stays-in-order-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/post-message-over-message-port-with-transfers-stays-in-order.html:
Added.
*
LayoutTests/http/tests/site-isolation/post-message-with-image-bitmap-stays-in-order-across-windows-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/post-message-with-image-bitmap-stays-in-order-across-windows.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/record-message-order-across-windows.html:
Added.
* LayoutTests/http/tests/site-isolation/resources/record-message-order.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/relay-message-order-to-opener-frame.html:
Added.
* Source/WebCore/platform/graphics/ImageBufferTransferIdentifier.h:
* Source/WebKit/GPUProcess/GPUProcess.cpp:
(WebKit::GPUProcess::handOverTransferredImageBuffers):
(WebKit::GPUProcess::depositTransferredImageBuffer):
(WebKit::GPUProcess::takeTransferredImageBuffer):
(WebKit::GPUProcess::removeTransferredImageBuffersForProcess):
(WebKit::GPUProcess::authorizeImageBufferTransfers): Deleted.
(WebKit::GPUProcess::takeSettledImageBufferTransferAuthorizations): Deleted.
* Source/WebKit/GPUProcess/GPUProcess.h:
* Source/WebKit/GPUProcess/GPUProcess.messages.in:
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::moveSerializedBufferToTransferHeap):
(WebKit::RemoteRenderingBackend::takeTransferredBuffer):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h:
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::takeAllMessagesForPort):
* Source/WebKit/Scripts/webkit/messages.py:
(serialized_identifiers):
(headers_for_type):
* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:
* Source/WebKit/Shared/ProcessQualified.serialization.in:
* Source/WebKit/Shared/WTFArgumentCoders.serialization.in:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::handOverTransferredImageBuffers):
(WebKit::NetworkProcessProxy::authorizeImageBufferTransfers): Deleted.
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::postMessageToRemote):
* Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.cpp:
(WebKit::RemoteSerializedImageBufferProxy::sinkIntoTransferHandle):
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::moveSerializedBufferToTransferHeap):
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:
Canonical link: https://commits.webkit.org/321862@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
