Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 28001e7f6612d5ffc6fdd9c2cbdeb32a0d3bc810
https://github.com/WebKit/WebKit/commit/28001e7f6612d5ffc6fdd9c2cbdeb32a0d3bc810
Author: Matt Woodrow <[email protected]>
Date: 2026-09-30 (Wed, 30 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-cross-site-frames-stay-in-order-expected.html
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-cross-site-frames-stay-in-order.html
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-placeholder-destroyed-while-committing-expected.txt
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-placeholder-destroyed-while-committing.html
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe-composited-expected.html
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe-composited.html
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe.html
A
LayoutTests/http/tests/site-isolation/resources/offscreen-canvas-draw-and-ack.html
M Source/WTF/WTF.xcodeproj/project.pbxproj
M Source/WTF/wtf/CMakeLists.txt
M Source/WTF/wtf/Forward.h
A Source/WTF/wtf/MonotonicObjectIdentifier.h
M Source/WTF/wtf/module.modulemap
M Source/WebCore/Headers.cmake
M Source/WebCore/SaferCPPExpectations/ForwardDeclCheckerExpectations
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/bindings/js/SerializedScriptValue.cpp
M Source/WebCore/bindings/js/SerializedScriptValueInternals.h
M Source/WebCore/html/OffscreenCanvas.cpp
M Source/WebCore/html/OffscreenCanvas.h
M Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm
M Source/WebCore/html/canvas/PlaceholderRenderingContext.cpp
M Source/WebCore/html/canvas/PlaceholderRenderingContext.h
A Source/WebCore/html/canvas/PlaceholderRenderingContextIdentifier.h
A Source/WebCore/html/canvas/PlaceholderRenderingContextSource.h
M Source/WebCore/page/Chrome.cpp
M Source/WebCore/page/Chrome.h
M Source/WebCore/page/ChromeClient.h
M Source/WebCore/platform/GraphicsClient.h
M Source/WebCore/platform/graphics/GraphicsLayerContentsDisplayDelegate.h
M Source/WebCore/platform/graphics/ImageBufferFormat.h
M Source/WebCore/platform/graphics/ImageBufferParameters.h
A Source/WebCore/platform/graphics/PlaceholderFrameIdentifier.h
M Source/WebCore/platform/graphics/ca/PlatformCALayer.mm
M Source/WebCore/platform/graphics/ca/PlatformCALayerDelegatedContents.h
M
Source/WebCore/platform/graphics/ca/cocoa/GraphicsLayerAsyncContentsDisplayDelegateCocoa.h
M
Source/WebCore/platform/graphics/ca/cocoa/GraphicsLayerAsyncContentsDisplayDelegateCocoa.mm
M
Source/WebCore/platform/graphics/coordinated/GraphicsLayerAsyncContentsDisplayDelegateCoordinated.cpp
M
Source/WebCore/platform/graphics/coordinated/GraphicsLayerAsyncContentsDisplayDelegateCoordinated.h
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.messages.in
M Source/WebKit/GPUProcess/GPUProcess.cpp
M Source/WebKit/GPUProcess/GPUProcess.h
M Source/WebKit/GPUProcess/GPUProcess.messages.in
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in
M Source/WebKit/Scripts/webkit/messages.py
M Source/WebKit/Scripts/webkit/opaque_ipc_types.tracking.in
M Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp
M Source/WebKit/Shared/IdentifierTypes.h
R Source/WebKit/Shared/MonotonicObjectIdentifier.h
M Source/WebKit/Shared/MonotonicObjectIdentifier.serialization.in
M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.h
M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm
M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTree.serialization.in
M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm
M Source/WebKit/Shared/RenderingUpdateID.h
M Source/WebKit/Shared/TransactionID.h
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/Sources.txt
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeNode.h
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeNode.mm
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Source/WebKit/UIProcess/WebProcessProxy.messages.in
M Source/WebKit/WebKit.xcodeproj/project.pbxproj
M Source/WebKit/WebKitPrefix.h
M Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
M
Source/WebKit/WebProcess/GPU/graphics/cocoa/RemoteGraphicsContextGLProxyCocoa.mm
M Source/WebKit/WebProcess/Model/WebModelPlayer.mm
A
Source/WebKit/WebProcess/WebCoreSupport/RemotePlaceholderRenderingContextSource.cpp
A
Source/WebKit/WebProcess/WebCoreSupport/RemotePlaceholderRenderingContextSource.h
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
M Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.cpp
M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/GraphicsLayerCARemote.mm
M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.h
M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.mm
M Source/WebKit/WebProcess/WebPage/WebPage.h
M Source/WebKit/WebProcess/WebProcess.cpp
M Source/WebKit/WebProcess/WebProcess.h
M Source/WebKit/WebProcess/WebProcess.messages.in
Log Message:
-----------
[Site Isolation] OffscreenCanvas transferred to a cross-site iframe never
paints
https://bugs.webkit.org/show_bug.cgi?id=325214
rdar://185246434
Reviewed by Kimmo Kinnunen.
postMessage of a DetachedOffscreenCanvas to a cross-site iframe dropped the
canvas due to the [NotSerialized] annotation, so the placeholder never painted.
Implement cross-process serialization of DetachedOffscreenCanvas using the
placeholder's identifier, and create a RemotePlaceholderRenderingContextSource
when decoded. Note that this can happen in the original process, if the message
bounces through multiple processes. Ideally we'd be able to get a
LocalPlaceholderRenderingContextSource again in that case, but for simplicity we
just continue using the remote variant.
To make that possible, split PlaceholderRenderingContextSource into an abstract
interface, in its own header so that WebKit can subclass it without pulling in
CanvasRenderingContext.h, and LocalPlaceholderRenderingContextSource, which
keeps
the same-process behavior. The source used to hold the placeholder's layer
delegate, which it updates straight from the OffscreenCanvas's thread, and the
frames last shown, so the placeholder had to keep the source for its whole life.
That state belongs to the placeholder whichever source feeds it, so it moves to
a
PlaceholderLayerContents that the placeholder owns and shares with a source in
its own process. The source is created for the OffscreenCanvas in
transferControlToOffscreen(), and only the canvas holds it.
PlaceholderRenderingContextIdentifier is an unguessable UUID, so knowing it is
the permission to commit frames to the placeholder, like
ImageBufferTransferIdentifier. The process owning the placeholder registers it
with the UI process on creation and unregisters it on destruction, which lets
the UI process route frames to the owner. The serialized canvas also carries
the owner's process identifier (RemotePlaceholderRenderingContextIdentifier).
A frame for a placeholder the UI process does not know may be for one that was
destroyed, or one whose registration is still in flight because the canvas came
by a route that bypasses the UI process, such as a MessagePort. The UI process
holds the newest such frame and pings the claimed owner; the reply follows any
registration the owner sent, so the frame is then delivered or released. The
committing process is told when the placeholder is gone, and stops sending
frames.
RemotePlaceholderRenderingContextSource implements frame transfer by requesting
a GPU-process buffer ownership transfer, and then notifying the UI process. The
UI process sets the buffer contents directly on the placeholder's layer as a
fast path, without waiting on a round-trip to the <canvas> process (which may be
slow, hence the use of OffscreenCanvas), taking the existing
asyncSetLayerContents path used by in-process OffscreenCanvas.
PlaceholderRenderingContext tells the UI process which layer displays the
placeholder, and keeps it up to date if it changes. The UI process also
forwards the buffer transfer request to the process holding the <canvas>, which
accepts ownership of the buffer so that reading back <canvas> pixels works.
The UI process throttles sending to the original process (since a slow main
thread is a primary use case for OffscreenCanvas), and releases buffers that
have been superseded to prevent memory buildup.
Frames are now ordered by a new PlaceholderFrameIdentifier, a
MonotonicObjectIdentifier, rather than by RenderingResourceIdentifier, since
transferring an ImageBuffer cross-process mints new identifiers. Each
OffscreenCanvas producer thus has a reliable ordering. The existing unsigned
buffer identifiers in PlaceholderRenderingContextSource use the same identifier.
This also fixes a bug where clearing the layer buffer didn't reset the
identifier correctly. MonotonicObjectIdentifier moves to WTF so that WebCore
can use it.
PlatformCALayerDelegatedContents::surfaceIdentifier is removed. No producer ever
set it; only the placeholder's delegate, which uses
PlatformCALayerRemoteDelegatedContents, needs one.
Also harden ImageBuffer transfer: the recipient of a transferred buffer
describes it to itself from the handle the sender wrote, so a sender lying about
its size, scale, purpose or rendering mode could get the recipient terminated
for using the buffer as described. Validate the handle against the buffer, and
prevent a claimed IOSurface from being recycled into the recipient's surface
pool, since the sender may have kept a send right to it.
Tests:
http/tests/site-isolation/offscreen-canvas-cross-site-frames-stay-in-order.html
http/tests/site-isolation/offscreen-canvas-placeholder-destroyed-while-committing.html
http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe-composited.html
http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe.html
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-cross-site-frames-stay-in-order-expected.html:
Added.
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-cross-site-frames-stay-in-order.html:
Added.
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-placeholder-destroyed-while-committing-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-placeholder-destroyed-while-committing.html:
Added.
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe-composited-expected.html:
Added.
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe-composited.html:
Added.
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/offscreen-canvas-transfer-to-cross-site-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/offscreen-canvas-draw-and-ack.html:
Added.
* Source/WTF/WTF.xcodeproj/project.pbxproj:
* Source/WTF/wtf/CMakeLists.txt:
* Source/WTF/wtf/Forward.h:
* Source/WTF/wtf/MonotonicObjectIdentifier.h: Renamed from
Source/WebKit/Shared/MonotonicObjectIdentifier.h.
* Source/WTF/wtf/module.modulemap:
* Source/WebCore/Headers.cmake:
* Source/WebCore/SaferCPPExpectations/ForwardDeclCheckerExpectations:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
* Source/WebCore/bindings/js/SerializedScriptValueInternals.h:
* Source/WebCore/html/OffscreenCanvas.cpp:
(WebCore::OffscreenCanvas::create):
* Source/WebCore/html/OffscreenCanvas.h:
* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:
* Source/WebCore/html/canvas/PlaceholderRenderingContext.cpp:
(WebCore::PlaceholderRenderingContextSource::setPlaceholderBuffer):
(WebCore::PlaceholderRenderingContextSource::setContentsToLayer):
(WebCore::PlaceholderLayerContents::copyFrame):
(WebCore::PlaceholderLayerContents::attach):
(WebCore::LocalPlaceholderRenderingContextSource::create):
(WebCore::LocalPlaceholderRenderingContextSource::LocalPlaceholderRenderingContextSource):
(WebCore::LocalPlaceholderRenderingContextSource::setPlaceholderBuffer):
(WebCore::PlaceholderRenderingContext::PlaceholderRenderingContext):
(WebCore::PlaceholderRenderingContext::setContentsToLayer):
(WebCore::PlaceholderRenderingContext::setPlaceholderBuffer):
(WebCore::PlaceholderRenderingContextSource::create): Deleted.
(WebCore::PlaceholderRenderingContextSource::PlaceholderRenderingContextSource):
Deleted.
(WebCore::PlaceholderRenderingContextSource::setPlaceholderBuffer): Deleted.
(WebCore::PlaceholderRenderingContextSource::setContentsToLayer): Deleted.
* Source/WebCore/html/canvas/PlaceholderRenderingContext.h:
(WebCore::PlaceholderRenderingContextSource::WTF_GUARDED_BY_LOCK): Deleted.
(WebCore::PlaceholderRenderingContextSource::WTF_GUARDED_BY_CAPABILITY):
Deleted.
(WebCore::PlaceholderRenderingContext::identifier const):
(WebCore::PlaceholderRenderingContext::layerContents const):
* Source/WebCore/html/canvas/PlaceholderRenderingContextIdentifier.h: Added.
* Source/WebCore/html/canvas/PlaceholderRenderingContextSource.h: Added.
(WebCore::PlaceholderRenderingContextSource::identifier const):
(WebCore::PlaceholderRenderingContextSource::PlaceholderRenderingContextSource):
* Source/WebCore/page/Chrome.cpp:
* Source/WebCore/page/Chrome.h:
* Source/WebCore/page/ChromeClient.h:
(WebCore::ChromeClient::offscreenCanvasPlaceholderLayerChanged):
* Source/WebCore/platform/GraphicsClient.h:
* Source/WebCore/platform/graphics/GraphicsLayerContentsDisplayDelegate.h:
(WebCore::GraphicsLayerAsyncContentsDisplayDelegate::destinationLayerID const):
* Source/WebCore/platform/graphics/ImageBufferFormat.h:
* Source/WebCore/platform/graphics/ImageBufferParameters.h:
* Source/WebCore/platform/graphics/PlaceholderFrameIdentifier.h: Copied from
Source/WebKit/Shared/TransactionID.h.
* Source/WebCore/platform/graphics/ca/PlatformCALayer.mm:
(WebCore::PlatformCALayer::setDelegatedContents):
* Source/WebCore/platform/graphics/ca/PlatformCALayerDelegatedContents.h:
*
Source/WebCore/platform/graphics/ca/cocoa/GraphicsLayerAsyncContentsDisplayDelegateCocoa.h:
*
Source/WebCore/platform/graphics/ca/cocoa/GraphicsLayerAsyncContentsDisplayDelegateCocoa.mm:
(WebCore::GraphicsLayerAsyncContentsDisplayDelegateCocoa::tryCopyToLayer):
*
Source/WebCore/platform/graphics/coordinated/GraphicsLayerAsyncContentsDisplayDelegateCoordinated.cpp:
(WebCore::GraphicsLayerAsyncContentsDisplayDelegateCoordinated::tryCopyToLayer):
*
Source/WebCore/platform/graphics/coordinated/GraphicsLayerAsyncContentsDisplayDelegateCoordinated.h:
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.messages.in:
* Source/WebKit/GPUProcess/GPUProcess.cpp:
* Source/WebKit/GPUProcess/GPUProcess.h:
* Source/WebKit/GPUProcess/GPUProcess.messages.in:
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::transferHandleDescribes):
(WebKit::RemoteRenderingBackend::takeTransferredBuffer):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h:
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in:
* Source/WebKit/Scripts/webkit/messages.py:
* Source/WebKit/Scripts/webkit/opaque_ipc_types.tracking.in: The layer contents
handle on the message is marked NeedsReview.
* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:
* Source/WebKit/Shared/IdentifierTypes.h:
* Source/WebKit/Shared/MonotonicObjectIdentifier.serialization.in:
* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.h:
(WebKit::RemoteLayerBackingStoreProperties::contentsFrameIdentifier const):
(WebKit::RemoteLayerBackingStoreProperties::contentsRenderingResourceIdentifier
const): Deleted.
* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::encode const):
(WebKit::RemoteLayerBackingStore::setDelegatedContents):
(WebKit::RemoteLayerBackingStoreProperties::RemoteLayerBackingStoreProperties):
(WebKit::RemoteLayerBackingStoreProperties::applyBackingStoreToNode):
* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTree.serialization.in:
* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:
(WebKit::RemoteLayerTreePropertyApplier::applyPropertiesToLayer):
* Source/WebKit/Shared/RenderingUpdateID.h:
* Source/WebKit/Shared/TransactionID.h:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/Sources.txt:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::asyncSetLayerContents):
(WebKit::RemoteLayerTreeDrawingAreaProxy::setLayerContentsFromAnotherProcess):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeNode.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeNode.mm:
(WebKit::RemoteLayerTreeNode::applyBackingStore):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setOffscreenCanvasPlaceholderLayer):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::offscreenCanvasPlaceholderLayers):
(WebKit::WebProcessProxy::setOffscreenCanvasPlaceholderLayer):
(WebKit::applyFrameToOffscreenCanvasPlaceholderLayer):
(WebKit::WebProcessProxy::offscreenCanvasPlaceholderDestroyed):
(WebKit::WebProcessProxy::removeOffscreenCanvasPlaceholderGrantsForProcess):
(WebKit::WebProcessProxy::commitOffscreenCanvasPlaceholderFrame):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Source/WebKit/UIProcess/WebProcessProxy.messages.in:
* Source/WebKit/WebKit.xcodeproj/project.pbxproj:
* Source/WebKit/WebKitPrefix.h:
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::takeTransferredBuffer):
*
Source/WebKit/WebProcess/GPU/graphics/cocoa/RemoteGraphicsContextGLProxyCocoa.mm:
* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:
*
Source/WebKit/WebProcess/WebCoreSupport/RemotePlaceholderRenderingContextSource.cpp:
Added.
(WebKit::RemotePlaceholderRenderingContextSource::setPlaceholderBuffer):
*
Source/WebKit/WebProcess/WebCoreSupport/RemotePlaceholderRenderingContextSource.h:
Added.
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::offscreenCanvasPlaceholderLayerChanged):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:
* Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.cpp:
* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/GraphicsLayerCARemote.mm:
* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.h:
* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.mm:
(WebKit::PlatformCALayerRemote::setDelegatedContents):
* Source/WebKit/WebProcess/WebPage/WebPage.h:
* Source/WebKit/WebProcess/WebProcess.cpp:
* Source/WebKit/WebProcess/WebProcess.h:
* Source/WebKit/WebProcess/WebProcess.messages.in:
Canonical link: https://commits.webkit.org/322360@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
