tree f4c932c56ba2330ba0e0686d03b32f9603747395
parent f144df958dc29f1b44735f98be8562e14118a6ff
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1655927947 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1655927947 +0000

REGRESSION(r294536): NativeImages copied from ImageBufferIOSurfaceBackend are mutated after copy
https://bugs.webkit.org/show_bug.cgi?id=241367

Patch by Kimmo Kinnunen <kkinnunen@apple.com> on 2022-06-22
Reviewed by Said Abou-Hallawa.

With GPUP, ImageBuffer IOSurface modifications happen in the GPUP.
In r294536 it was changed that WP creates NativeImage instances with CGImage instances
created from IOSurfaces mapped in WP. These CGImages do not know that the underlying IOSurface changes
in the other process.

Detach the CGImages from the IOSurface before the first write to the ImageBuffer
is being sent to GPUP. This is done with the ensureNativeImagesHaveCopiedBackingStore() call.

* LayoutTests/fast/canvas/canvas-pattern-from-modified-canvas-expected.txt: Added.
* LayoutTests/fast/canvas/canvas-pattern-from-modified-canvas.html: Added.
* Source/WebCore/platform/graphics/ImageBuffer.h:
(WebCore::ImageBuffer::backingStoreWillChange):
(WebCore::ImageBuffer::setNeedsFlush): Deleted.
* Source/WebCore/platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp:
(WebCore::ImageBufferIOSurfaceBackend::~ImageBufferIOSurfaceBackend):
(WebCore::ImageBufferIOSurfaceBackend::invalidateCachedNativeImage const):
(WebCore::ImageBufferIOSurfaceBackend::copyNativeImage const):
(WebCore::ImageBufferIOSurfaceBackend::ensureNativeImagesHaveCopiedBackingStore):
* Source/WebCore/platform/graphics/cg/ImageBufferIOSurfaceBackend.h:
* Source/WebKit/WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.h:
(WebKit::RemoteDisplayListRecorderProxy::send):
* Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h:
(WebKit::RemoteImageBufferProxy::setNeedsFlush):
(WebKit::RemoteImageBufferProxy::prepareForBackingStoreChange):

Canonical link: https://commits.webkit.org/251751@main

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@295746 268f45cc-cd09-0410-ab3c-d52691b4dbfc