GPU Process: IOSurfaces should not be mapped into the Web Content Process
https://bugs.webkit.org/show_bug.cgi?id=219368

Reviewed by Said Abou-Hallawa.

Source/WebCore:

* platform/graphics/ConcreteImageBuffer.h:
* platform/graphics/ImageBuffer.h:
* platform/graphics/ImageBufferBackend.h:
* platform/graphics/cg/ImageBufferIOSurfaceBackend.h:
Make it possible to determine if an image buffer's backend is capable of mapping the backing store in-process or not.

Source/WebKit:

Since the Web Content process sandbox will eventually not have access to IOKit,
it will not be able to map/lock/use IOSurfaces. Thankfully, all it really needs
to be able to do is carry a reference to the surface from the GPU process to the
UI process (where it is mapped and applied as layer contents).

* GPUProcess/graphics/PlatformRemoteImageBuffer.h:
* Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::encode const):
(WebKit::RemoteLayerBackingStore::swapToValidFrontBuffer):
* SourcesCocoa.txt:
* WebKit.xcodeproj/project.pbxproj:
* WebProcess/GPU/graphics/PlatformImageBufferShareableBackend.h:
* WebProcess/GPU/graphics/PlatformRemoteImageBufferProxy.h:
(isType):
* WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::reestablishGPUProcessConnection):
(WebKit::RemoteRenderingBackendProxy::createImageBuffer):
(WebKit::RemoteRenderingBackendProxy::imageBufferBackendWasCreated):
(WebKit::RemoteRenderingBackendProxy::didFlush):

* WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp:
(WebKit::ImageBufferShareableIOSurfaceBackend::create):
(WebKit::ImageBufferShareableIOSurfaceBackend::createImageBufferBackendHandle const):
(WebKit::ImageBufferShareableIOSurfaceBackend::context const):
(WebKit::ImageBufferShareableIOSurfaceBackend::copyNativeImage const):
(WebKit::ImageBufferShareableIOSurfaceBackend::copyImage const):
(WebKit::ImageBufferShareableIOSurfaceBackend::draw):
(WebKit::ImageBufferShareableIOSurfaceBackend::drawPattern):
(WebKit::ImageBufferShareableIOSurfaceBackend::toDataURL const):
(WebKit::ImageBufferShareableIOSurfaceBackend::toData const):
(WebKit::ImageBufferShareableIOSurfaceBackend::toBGRAData const):
(WebKit::ImageBufferShareableIOSurfaceBackend::getImageData const):
(WebKit::ImageBufferShareableIOSurfaceBackend::putImageData):
* WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h:
* WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp: Copied from Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp.
(WebKit::ImageBufferShareableMappedIOSurfaceBackend::create):
(WebKit::ImageBufferShareableMappedIOSurfaceBackend::createImageBufferBackendHandle const):
* WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.h: Copied from Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h.
Rename ImageBufferShareableIOSurfaceBackend to ImageBufferShareableMappedIOSurfaceBackend.
Readd ImageBufferShareableIOSurfaceBackend, the unmapped variant. The mapped variant is only used:
- in the GPU process
- in the Web Content process when DOM rendering in the GPU process is disabled

The unmapped variant cannot perform most ImageBufferBackend duties, except creating an ImageBufferBackendHandle,
which it does by cloning the existing handle. It explicitly does *not* map the IOSurface in the
process, and is meant for use in Web Content processes that do not have access to IOSurface.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@270342 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 2f310f5..ec85ab9 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2020-12-01  Tim Horton  <timothy_horton@apple.com>
+
+        GPU Process: IOSurfaces should not be mapped into the Web Content Process
+        https://bugs.webkit.org/show_bug.cgi?id=219368
+
+        Reviewed by Said Abou-Hallawa.
+
+        * platform/graphics/ConcreteImageBuffer.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/ImageBufferBackend.h:
+        * platform/graphics/cg/ImageBufferIOSurfaceBackend.h:
+        Make it possible to determine if an image buffer's backend is capable of mapping the backing store in-process or not.
+
 2020-12-01  Andres Gonzalez  <andresg_22@apple.com>
 
         Fix for accessibility attributed string tests in isolated mode.
diff --git a/Source/WebCore/platform/graphics/ConcreteImageBuffer.h b/Source/WebCore/platform/graphics/ConcreteImageBuffer.h
index 8242990..7e6d93e 100644
--- a/Source/WebCore/platform/graphics/ConcreteImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ConcreteImageBuffer.h
@@ -52,6 +52,7 @@
     }
 
     bool isAccelerated() const override { return BackendType::isAccelerated; }
+    bool canMapBackingStore() const override { return BackendType::canMapBackingStore; }
 
 protected:
     ConcreteImageBuffer(std::unique_ptr<BackendType>&& backend = nullptr, RenderingResourceIdentifier renderingResourceIdentifier = RenderingResourceIdentifier::generate())
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index 62a3f7f..b66603d 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -64,6 +64,7 @@
     WEBCORE_EXPORT virtual ~ImageBuffer() = default;
 
     virtual bool isAccelerated() const = 0;
+    virtual bool canMapBackingStore() const = 0;
     virtual RenderingResourceIdentifier renderingResourceIdentifier() const { return { }; }
     
     virtual GraphicsContext& context() const = 0;
diff --git a/Source/WebCore/platform/graphics/ImageBufferBackend.h b/Source/WebCore/platform/graphics/ImageBufferBackend.h
index 5806715..6808405 100644
--- a/Source/WebCore/platform/graphics/ImageBufferBackend.h
+++ b/Source/WebCore/platform/graphics/ImageBufferBackend.h
@@ -128,6 +128,7 @@
     
     static constexpr bool isOriginAtUpperLeftCorner = false;
     static constexpr bool isAccelerated = false;
+    static constexpr bool canMapBackingStore = true;
 
 protected:
     WEBCORE_EXPORT ImageBufferBackend(const FloatSize& logicalSize, const IntSize& backendSize, float resolutionScale, ColorSpace, PixelFormat);
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 9257d5e..9b3544c 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,57 @@
+2020-12-01  Tim Horton  <timothy_horton@apple.com>
+
+        GPU Process: IOSurfaces should not be mapped into the Web Content Process
+        https://bugs.webkit.org/show_bug.cgi?id=219368
+
+        Reviewed by Said Abou-Hallawa.
+
+        Since the Web Content process sandbox will eventually not have access to IOKit,
+        it will not be able to map/lock/use IOSurfaces. Thankfully, all it really needs
+        to be able to do is carry a reference to the surface from the GPU process to the
+        UI process (where it is mapped and applied as layer contents).
+
+        * GPUProcess/graphics/PlatformRemoteImageBuffer.h:
+        * Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
+        (WebKit::RemoteLayerBackingStore::encode const):
+        (WebKit::RemoteLayerBackingStore::swapToValidFrontBuffer):
+        * SourcesCocoa.txt:
+        * WebKit.xcodeproj/project.pbxproj:
+        * WebProcess/GPU/graphics/PlatformImageBufferShareableBackend.h:
+        * WebProcess/GPU/graphics/PlatformRemoteImageBufferProxy.h:
+        (isType):
+        * WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
+        (WebKit::RemoteRenderingBackendProxy::reestablishGPUProcessConnection):
+        (WebKit::RemoteRenderingBackendProxy::createImageBuffer):
+        (WebKit::RemoteRenderingBackendProxy::imageBufferBackendWasCreated):
+        (WebKit::RemoteRenderingBackendProxy::didFlush):
+
+        * WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp:
+        (WebKit::ImageBufferShareableIOSurfaceBackend::create):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::createImageBufferBackendHandle const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::context const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::copyNativeImage const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::copyImage const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::draw):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::drawPattern):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::toDataURL const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::toData const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::toBGRAData const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::getImageData const):
+        (WebKit::ImageBufferShareableIOSurfaceBackend::putImageData):
+        * WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h:
+        * WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp: Copied from Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp.
+        (WebKit::ImageBufferShareableMappedIOSurfaceBackend::create):
+        (WebKit::ImageBufferShareableMappedIOSurfaceBackend::createImageBufferBackendHandle const):
+        * WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.h: Copied from Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h.
+        Rename ImageBufferShareableIOSurfaceBackend to ImageBufferShareableMappedIOSurfaceBackend.
+        Readd ImageBufferShareableIOSurfaceBackend, the unmapped variant. The mapped variant is only used:
+        - in the GPU process
+        - in the Web Content process when DOM rendering in the GPU process is disabled
+
+        The unmapped variant cannot perform most ImageBufferBackend duties, except creating an ImageBufferBackendHandle,
+        which it does by cloning the existing handle. It explicitly does *not* map the IOSurface in the
+        process, and is meant for use in Web Content processes that do not have access to IOSurface.
+
 2020-12-01  Peng Liu  <peng.liu6@apple.com>
 
         [Media In GPU Process][MSE] Add the support to forward initialization segment from the GPU Process to Web processes
diff --git a/Source/WebKit/GPUProcess/graphics/PlatformRemoteImageBuffer.h b/Source/WebKit/GPUProcess/graphics/PlatformRemoteImageBuffer.h
index ba2728f..108ed6c 100644
--- a/Source/WebKit/GPUProcess/graphics/PlatformRemoteImageBuffer.h
+++ b/Source/WebKit/GPUProcess/graphics/PlatformRemoteImageBuffer.h
@@ -33,7 +33,7 @@
 namespace WebKit {
 
 using UnacceleratedRemoteImageBuffer = RemoteImageBuffer<UnacceleratedImageBufferShareableBackend>;
-using AcceleratedRemoteImageBuffer = RemoteImageBuffer<AcceleratedImageBufferShareableBackend>;
+using AcceleratedRemoteImageBuffer = RemoteImageBuffer<AcceleratedImageBufferShareableMappedBackend>;
 
 } // namespace WebKit
 
diff --git a/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm b/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm
index eb54590..e84c350 100644
--- a/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm
+++ b/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm
@@ -113,7 +113,7 @@
                 handle = static_cast<UnacceleratedRemoteImageBufferProxy *>(m_frontBuffer.imageBuffer.get())->createImageBufferBackendHandle();
         } else {
             if (m_acceleratesDrawing)
-                handle = static_cast<ConcreteShareableImageBuffer<AcceleratedImageBufferShareableBackend> *>(m_frontBuffer.imageBuffer.get())->createImageBufferBackendHandle();
+                handle = static_cast<ConcreteShareableImageBuffer<AcceleratedImageBufferShareableMappedBackend> *>(m_frontBuffer.imageBuffer.get())->createImageBufferBackendHandle();
             else
                 handle = static_cast<ConcreteShareableImageBuffer<UnacceleratedImageBufferShareableBackend> *>(m_frontBuffer.imageBuffer.get())->createImageBufferBackendHandle();
         }
@@ -193,7 +193,7 @@
     }
 
     if (m_acceleratesDrawing)
-        m_frontBuffer.imageBuffer = ConcreteShareableImageBuffer<AcceleratedImageBufferShareableBackend>::create(backingStoreSize(), WebCore::RenderingMode::Accelerated, 1, WebCore::ColorSpace::SRGB, pixelFormat());
+        m_frontBuffer.imageBuffer = ConcreteShareableImageBuffer<AcceleratedImageBufferShareableMappedBackend>::create(backingStoreSize(), WebCore::RenderingMode::Accelerated, 1, WebCore::ColorSpace::SRGB, pixelFormat());
     else
         m_frontBuffer.imageBuffer = ConcreteShareableImageBuffer<UnacceleratedImageBufferShareableBackend>::create(backingStoreSize(), WebCore::RenderingMode::Unaccelerated, 1, WebCore::ColorSpace::SRGB, pixelFormat());
 }
diff --git a/Source/WebKit/SourcesCocoa.txt b/Source/WebKit/SourcesCocoa.txt
index fcdf2f6..4ea8b78 100644
--- a/Source/WebKit/SourcesCocoa.txt
+++ b/Source/WebKit/SourcesCocoa.txt
@@ -574,6 +574,7 @@
 WebProcess/EntryPoint/Cocoa/XPCService/WebContentServiceEntryPoint.mm
 
 WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp
+WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp
 WebProcess/GPU/media/RemoteAudioSourceProvider.cpp
 WebProcess/GPU/media/RemoteAudioSourceProviderManager.cpp
 WebProcess/GPU/media/cocoa/MediaPlayerPrivateRemoteCocoa.mm
diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
index 3534f10..0cc063f 100644
--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -2970,6 +2970,8 @@
 		2D1E8221216FFF5000A15265 /* WKWebEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WKWebEvent.h; path = ios/WKWebEvent.h; sourceTree = "<group>"; };
 		2D1E8222216FFF5100A15265 /* WKWebEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WKWebEvent.mm; path = ios/WKWebEvent.mm; sourceTree = "<group>"; };
 		2D25F3272575872400231A8B /* ConcreteShareableImageBuffer.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ConcreteShareableImageBuffer.h; sourceTree = "<group>"; };
+		2D25F32825758E9000231A8B /* ImageBufferShareableIOSurfaceBackend.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ImageBufferShareableIOSurfaceBackend.h; sourceTree = "<group>"; };
+		2D25F32925758E9100231A8B /* ImageBufferShareableIOSurfaceBackend.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = ImageBufferShareableIOSurfaceBackend.cpp; sourceTree = "<group>"; };
 		2D28A4951AF965A100F190C9 /* WKViewLayoutStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKViewLayoutStrategy.h; sourceTree = "<group>"; };
 		2D28A4961AF965A100F190C9 /* WKViewLayoutStrategy.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WKViewLayoutStrategy.mm; sourceTree = "<group>"; };
 		2D28F3E01885CCC1004B9EAE /* WebChromeClientIOS.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WebChromeClientIOS.mm; path = ios/WebChromeClientIOS.mm; sourceTree = "<group>"; };
@@ -4339,8 +4341,8 @@
 		7227800B2408BD7D007D376B /* PlatformRemoteImageBufferProxy.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = PlatformRemoteImageBufferProxy.h; sourceTree = "<group>"; };
 		726D56DD253A64810002EF90 /* RemoteResourceCache.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = RemoteResourceCache.cpp; sourceTree = "<group>"; };
 		726D56DE253A64810002EF90 /* RemoteResourceCache.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = RemoteResourceCache.h; sourceTree = "<group>"; };
-		727A7F342407857D004D2931 /* ImageBufferShareableIOSurfaceBackend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageBufferShareableIOSurfaceBackend.cpp; sourceTree = "<group>"; };
-		727A7F352407857F004D2931 /* ImageBufferShareableIOSurfaceBackend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferShareableIOSurfaceBackend.h; sourceTree = "<group>"; };
+		727A7F342407857D004D2931 /* ImageBufferShareableMappedIOSurfaceBackend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageBufferShareableMappedIOSurfaceBackend.cpp; sourceTree = "<group>"; };
+		727A7F352407857F004D2931 /* ImageBufferShareableMappedIOSurfaceBackend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferShareableMappedIOSurfaceBackend.h; sourceTree = "<group>"; };
 		727A7F36240788F0004D2931 /* ImageBufferShareableBitmapBackend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferShareableBitmapBackend.h; sourceTree = "<group>"; };
 		727A7F37240788F0004D2931 /* ImageBufferShareableBitmapBackend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageBufferShareableBitmapBackend.cpp; sourceTree = "<group>"; };
 		727A7F38240788F0004D2931 /* PlatformImageBufferShareableBackend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformImageBufferShareableBackend.h; sourceTree = "<group>"; };
@@ -8748,8 +8750,10 @@
 		727A7F3324078527004D2931 /* cocoa */ = {
 			isa = PBXGroup;
 			children = (
-				727A7F342407857D004D2931 /* ImageBufferShareableIOSurfaceBackend.cpp */,
-				727A7F352407857F004D2931 /* ImageBufferShareableIOSurfaceBackend.h */,
+				2D25F32925758E9100231A8B /* ImageBufferShareableIOSurfaceBackend.cpp */,
+				2D25F32825758E9000231A8B /* ImageBufferShareableIOSurfaceBackend.h */,
+				727A7F342407857D004D2931 /* ImageBufferShareableMappedIOSurfaceBackend.cpp */,
+				727A7F352407857F004D2931 /* ImageBufferShareableMappedIOSurfaceBackend.h */,
 			);
 			path = cocoa;
 			sourceTree = "<group>";
diff --git a/Source/WebKit/WebProcess/GPU/graphics/PlatformImageBufferShareableBackend.h b/Source/WebKit/WebProcess/GPU/graphics/PlatformImageBufferShareableBackend.h
index 849c60d..c88d9d7 100644
--- a/Source/WebKit/WebProcess/GPU/graphics/PlatformImageBufferShareableBackend.h
+++ b/Source/WebKit/WebProcess/GPU/graphics/PlatformImageBufferShareableBackend.h
@@ -31,6 +31,7 @@
 
 #if HAVE(IOSURFACE)
 #include "ImageBufferShareableIOSurfaceBackend.h"
+#include "ImageBufferShareableMappedIOSurfaceBackend.h"
 #endif
 
 namespace WebKit {
@@ -39,8 +40,10 @@
 
 #if HAVE(IOSURFACE)
 using AcceleratedImageBufferShareableBackend = ImageBufferShareableIOSurfaceBackend;
+using AcceleratedImageBufferShareableMappedBackend = ImageBufferShareableMappedIOSurfaceBackend;
 #else
 using AcceleratedImageBufferShareableBackend = UnacceleratedImageBufferShareableBackend;
+using AcceleratedImageBufferShareableMappedBackend = UnacceleratedImageBufferShareableBackend;
 #endif
 
 } // namespace WebKit
diff --git a/Source/WebKit/WebProcess/GPU/graphics/PlatformRemoteImageBufferProxy.h b/Source/WebKit/WebProcess/GPU/graphics/PlatformRemoteImageBufferProxy.h
index 0517678..a008206 100644
--- a/Source/WebKit/WebProcess/GPU/graphics/PlatformRemoteImageBufferProxy.h
+++ b/Source/WebKit/WebProcess/GPU/graphics/PlatformRemoteImageBufferProxy.h
@@ -34,6 +34,7 @@
 
 using UnacceleratedRemoteImageBufferProxy = RemoteImageBufferProxy<UnacceleratedImageBufferShareableBackend>;
 using AcceleratedRemoteImageBufferProxy = RemoteImageBufferProxy<AcceleratedImageBufferShareableBackend>;
+using AcceleratedRemoteImageBufferMappedProxy = RemoteImageBufferProxy<AcceleratedImageBufferShareableMappedBackend>;
 
 } // namespace WebKit
 
@@ -43,7 +44,11 @@
 
 #if HAVE(IOSURFACE)
 SPECIALIZE_TYPE_TRAITS_BEGIN(WebKit::AcceleratedRemoteImageBufferProxy)
-    static bool isType(const WebCore::ImageBuffer& imageBuffer) { return imageBuffer.renderingResourceIdentifier() && imageBuffer.isAccelerated(); }
+    static bool isType(const WebCore::ImageBuffer& imageBuffer) { return imageBuffer.renderingResourceIdentifier() && imageBuffer.isAccelerated() && !imageBuffer.canMapBackingStore(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(WebKit::AcceleratedRemoteImageBufferMappedProxy)
+    static bool isType(const WebCore::ImageBuffer& imageBuffer) { return imageBuffer.renderingResourceIdentifier() && imageBuffer.isAccelerated() && imageBuffer.canMapBackingStore(); }
 SPECIALIZE_TYPE_TRAITS_END()
 #endif
 
diff --git a/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp b/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
index c07b23f..c8a3230 100644
--- a/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
+++ b/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
@@ -83,7 +83,9 @@
 
     for (auto& pair : m_remoteResourceCacheProxy.imageBuffers()) {
         if (auto& baseImageBuffer = pair.value) {
-            if (is<AcceleratedRemoteImageBufferProxy>(*baseImageBuffer))
+            if (is<AcceleratedRemoteImageBufferMappedProxy>(*baseImageBuffer))
+                recreateImageBuffer(*this, downcast<AcceleratedRemoteImageBufferMappedProxy>(*baseImageBuffer), pair.key, m_renderingBackendIdentifier);
+            else if (is<AcceleratedRemoteImageBufferProxy>(*baseImageBuffer))
                 recreateImageBuffer(*this, downcast<AcceleratedRemoteImageBufferProxy>(*baseImageBuffer), pair.key, m_renderingBackendIdentifier);
             else
                 recreateImageBuffer(*this, downcast<UnacceleratedRemoteImageBufferProxy>(*baseImageBuffer), pair.key, m_renderingBackendIdentifier);
@@ -128,8 +130,15 @@
 {
     RefPtr<ImageBuffer> imageBuffer;
 
-    if (renderingMode == RenderingMode::Accelerated)
-        imageBuffer = AcceleratedRemoteImageBufferProxy::create(size, renderingMode, resolutionScale, colorSpace, pixelFormat, *this);
+    if (renderingMode == RenderingMode::Accelerated) {
+        // Unless DOM rendering is always enabled when any GPU process rendering is enabled,
+        // we need to create ImageBuffers for e.g. Canvas that are actually mapped into the
+        // Web Content process, so they can be painted into the tiles.
+        if (!WebProcess::singleton().shouldUseRemoteRenderingFor(RenderingPurpose::DOM))
+            imageBuffer = AcceleratedRemoteImageBufferMappedProxy::create(size, renderingMode, resolutionScale, colorSpace, pixelFormat, *this);
+        else
+            imageBuffer = AcceleratedRemoteImageBufferProxy::create(size, renderingMode, resolutionScale, colorSpace, pixelFormat, *this);
+    }
 
     if (!imageBuffer)
         imageBuffer = UnacceleratedRemoteImageBufferProxy::create(size, renderingMode, resolutionScale, colorSpace, pixelFormat, *this);
@@ -188,8 +197,10 @@
     auto imageBuffer = m_remoteResourceCacheProxy.cachedImageBuffer(renderingResourceIdentifier);
     if (!imageBuffer)
         return;
-    
-    if (imageBuffer->isAccelerated())
+
+    if (is<AcceleratedRemoteImageBufferMappedProxy>(*imageBuffer))
+        downcast<AcceleratedRemoteImageBufferMappedProxy>(*imageBuffer).createBackend(logicalSize, backendSize, resolutionScale, colorSpace, pixelFormat, WTFMove(handle));
+    else if (is<AcceleratedRemoteImageBufferProxy>(*imageBuffer))
         downcast<AcceleratedRemoteImageBufferProxy>(*imageBuffer).createBackend(logicalSize, backendSize, resolutionScale, colorSpace, pixelFormat, WTFMove(handle));
     else
         downcast<UnacceleratedRemoteImageBufferProxy>(*imageBuffer).createBackend(logicalSize, backendSize, resolutionScale, colorSpace, pixelFormat, WTFMove(handle));
@@ -201,7 +212,9 @@
     if (!imageBuffer)
         return;
 
-    if (imageBuffer->isAccelerated())
+    if (is<AcceleratedRemoteImageBufferMappedProxy>(*imageBuffer))
+        downcast<AcceleratedRemoteImageBufferMappedProxy>(*imageBuffer).didFlush(flushIdentifier);
+    else if (is<AcceleratedRemoteImageBufferProxy>(*imageBuffer))
         downcast<AcceleratedRemoteImageBufferProxy>(*imageBuffer).didFlush(flushIdentifier);
     else
         downcast<UnacceleratedRemoteImageBufferProxy>(*imageBuffer).didFlush(flushIdentifier);
diff --git a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp
index 51627c5..ceda712 100644
--- a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp
+++ b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "ImageBufferShareableIOSurfaceBackend.h"
 
-#if ENABLE(GPU_PROCESS)
+#if HAVE(IOSURFACE)
 
 #include <WebCore/GraphicsContextCG.h>
 #include <wtf/IsoMallocInlines.h>
@@ -37,44 +37,78 @@
 
 WTF_MAKE_ISO_ALLOCATED_IMPL(ImageBufferShareableIOSurfaceBackend);
 
-std::unique_ptr<ImageBufferShareableIOSurfaceBackend> ImageBufferShareableIOSurfaceBackend::create(const FloatSize& size, float resolutionScale, ColorSpace colorSpace, PixelFormat pixelFormat, const HostWindow*)
-{
-    IntSize backendSize = calculateBackendSize(size, resolutionScale);
-    if (backendSize.isEmpty())
-        return nullptr;
-
-    auto surface = IOSurface::create(backendSize, backendSize, cachedCGColorSpace(colorSpace), IOSurface::formatForPixelFormat(pixelFormat));
-    if (!surface)
-        return nullptr;
-
-    RetainPtr<CGContextRef> cgContext = surface->ensurePlatformContext();
-    if (!cgContext)
-        return nullptr;
-
-    CGContextClearRect(cgContext.get(), FloatRect(FloatPoint::zero(), backendSize));
-
-    return makeUnique<ImageBufferShareableIOSurfaceBackend>(size, backendSize, resolutionScale, colorSpace, pixelFormat, WTFMove(surface));
-}
-
-std::unique_ptr<ImageBufferShareableIOSurfaceBackend> ImageBufferShareableIOSurfaceBackend::create(const FloatSize& logicalSize, const IntSize& internalSize, float resolutionScale, ColorSpace colorSpace, PixelFormat pixelFormat, ImageBufferBackendHandle handle)
+std::unique_ptr<ImageBufferShareableIOSurfaceBackend> ImageBufferShareableIOSurfaceBackend::create(const FloatSize& logicalSize, const IntSize& backendSize, float resolutionScale, ColorSpace colorSpace, PixelFormat pixelFormat, ImageBufferBackendHandle handle)
 {
     if (!WTF::holds_alternative<MachSendRight>(handle)) {
-        ASSERT_NOT_REACHED();
+        RELEASE_ASSERT_NOT_REACHED();
         return nullptr;
     }
 
-    auto surface = IOSurface::createFromSendRight(WTFMove(WTF::get<MachSendRight>(handle)), cachedCGColorSpace(colorSpace));
-    if (!surface)
-        return nullptr;
-
-    return makeUnique<ImageBufferShareableIOSurfaceBackend>(logicalSize, internalSize, resolutionScale, colorSpace, pixelFormat, WTFMove(surface));
+    return makeUnique<ImageBufferShareableIOSurfaceBackend>(logicalSize, backendSize, resolutionScale, colorSpace, pixelFormat, WTFMove(handle));
 }
 
 ImageBufferBackendHandle ImageBufferShareableIOSurfaceBackend::createImageBufferBackendHandle() const
 {
-    return ImageBufferBackendHandle(m_surface->createSendRight());
+    return WTF::get<MachSendRight>(m_handle).copySendRight();
+}
+
+GraphicsContext& ImageBufferShareableIOSurfaceBackend::context() const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return *(GraphicsContext*)nullptr;
+}
+
+RefPtr<NativeImage> ImageBufferShareableIOSurfaceBackend::copyNativeImage(BackingStoreCopy) const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return { };
+}
+
+RefPtr<Image> ImageBufferShareableIOSurfaceBackend::copyImage(BackingStoreCopy, PreserveResolution) const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return { };
+}
+
+void ImageBufferShareableIOSurfaceBackend::draw(GraphicsContext&, const FloatRect&, const FloatRect&, const ImagePaintingOptions&)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ImageBufferShareableIOSurfaceBackend::drawPattern(GraphicsContext&, const FloatRect&, const FloatRect&, const AffineTransform&, const FloatPoint&, const FloatSize&, const ImagePaintingOptions&)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+String ImageBufferShareableIOSurfaceBackend::toDataURL(const String&, Optional<double>, PreserveResolution) const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return { };
+}
+
+Vector<uint8_t> ImageBufferShareableIOSurfaceBackend::toData(const String&, Optional<double>) const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return { };
+}
+
+Vector<uint8_t> ImageBufferShareableIOSurfaceBackend::toBGRAData() const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return { };
+}
+
+RefPtr<ImageData> ImageBufferShareableIOSurfaceBackend::getImageData(AlphaPremultiplication, const IntRect&) const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return { };
+}
+
+void ImageBufferShareableIOSurfaceBackend::putImageData(AlphaPremultiplication, const ImageData&, const IntRect&, const IntPoint&, AlphaPremultiplication)
+{
+    RELEASE_ASSERT_NOT_REACHED();
 }
 
 } // namespace WebKit
 
-#endif // ENABLE(GPU_PROCESS) && HAVE(IOSURFACE)
+#endif // HAVE(IOSURFACE)
diff --git a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h
index ed51624..7c1eed6 100644
--- a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h
+++ b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h
@@ -25,28 +25,50 @@
 
 #pragma once
 
-#if ENABLE(GPU_PROCESS)
+#if HAVE(IOSURFACE)
 
 #include "ImageBufferBackendHandle.h"
-#include <WebCore/ImageBufferIOSurfaceBackend.h>
+#include <WebCore/GraphicsContext.h>
+#include <WebCore/ImageBufferBackend.h>
 #include <wtf/IsoMalloc.h>
 
 namespace WebKit {
 
 class ShareableBitmap;
 
-class ImageBufferShareableIOSurfaceBackend : public WebCore::ImageBufferIOSurfaceBackend {
+class ImageBufferShareableIOSurfaceBackend final : public WebCore::ImageBufferBackend {
     WTF_MAKE_ISO_ALLOCATED(ImageBufferShareableIOSurfaceBackend);
     WTF_MAKE_NONCOPYABLE(ImageBufferShareableIOSurfaceBackend);
 public:
-    static std::unique_ptr<ImageBufferShareableIOSurfaceBackend> create(const WebCore::FloatSize& logicalSize, const float resolutionScale, WebCore::ColorSpace, WebCore::PixelFormat, const WebCore::HostWindow*);
-    static std::unique_ptr<ImageBufferShareableIOSurfaceBackend> create(const WebCore::FloatSize& logicalSize, const WebCore::IntSize& internalSize, float resolutionScale, WebCore::ColorSpace, WebCore::PixelFormat, ImageBufferBackendHandle);
+    static std::unique_ptr<ImageBufferShareableIOSurfaceBackend> create(const WebCore::FloatSize& logicalSize, const WebCore::IntSize& backendSize, float resolutionScale, WebCore::ColorSpace, WebCore::PixelFormat, ImageBufferBackendHandle);
 
-    using WebCore::ImageBufferIOSurfaceBackend::ImageBufferIOSurfaceBackend;
+    ImageBufferShareableIOSurfaceBackend(const WebCore::FloatSize& logicalSize, const WebCore::IntSize& physicalSize, float resolutionScale, WebCore::ColorSpace colorSpace, WebCore::PixelFormat pixelFormat, ImageBufferBackendHandle&& handle)
+        : ImageBufferBackend(logicalSize, physicalSize, resolutionScale, colorSpace, pixelFormat)
+        , m_handle(WTFMove(handle))
+    {
+    }
 
     ImageBufferBackendHandle createImageBufferBackendHandle() const;
+
+    WebCore::GraphicsContext& context() const override;
+    RefPtr<WebCore::NativeImage> copyNativeImage(WebCore::BackingStoreCopy) const override;
+    RefPtr<WebCore::Image> copyImage(WebCore::BackingStoreCopy, WebCore::PreserveResolution) const override;
+    void draw(WebCore::GraphicsContext&, const WebCore::FloatRect& destRect, const WebCore::FloatRect& srcRect, const WebCore::ImagePaintingOptions&) override;
+    void drawPattern(WebCore::GraphicsContext&, const WebCore::FloatRect& destRect, const WebCore::FloatRect& srcRect, const WebCore::AffineTransform& patternTransform, const WebCore::FloatPoint& phase, const WebCore::FloatSize& spacing, const WebCore::ImagePaintingOptions&) override;
+    String toDataURL(const String& mimeType, Optional<double> quality, WebCore::PreserveResolution) const override;
+    Vector<uint8_t> toData(const String& mimeType, Optional<double> quality) const override;
+    Vector<uint8_t> toBGRAData() const override;
+    RefPtr<WebCore::ImageData> getImageData(WebCore::AlphaPremultiplication outputFormat, const WebCore::IntRect&) const override;
+    void putImageData(WebCore::AlphaPremultiplication inputFormat, const WebCore::ImageData&, const WebCore::IntRect& srcRect, const WebCore::IntPoint& destPoint, WebCore::AlphaPremultiplication destFormat) override;
+
+    static constexpr bool isOriginAtUpperLeftCorner = true;
+    static constexpr bool isAccelerated = true;
+    static constexpr bool canMapBackingStore = false;
+
+private:
+    ImageBufferBackendHandle m_handle;
 };
 
 } // namespace WebKit
 
-#endif // ENABLE(GPU_PROCESS)
+#endif // HAVE(IOSURFACE)
diff --git a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp
new file mode 100644
index 0000000..450de44
--- /dev/null
+++ b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2020 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageBufferShareableMappedIOSurfaceBackend.h"
+
+#if ENABLE(GPU_PROCESS) && HAVE(IOSURFACE)
+
+#include <WebCore/GraphicsContextCG.h>
+#include <wtf/IsoMallocInlines.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebKit {
+using namespace WebCore;
+
+WTF_MAKE_ISO_ALLOCATED_IMPL(ImageBufferShareableMappedIOSurfaceBackend);
+
+std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> ImageBufferShareableMappedIOSurfaceBackend::create(const FloatSize& size, float resolutionScale, ColorSpace colorSpace, PixelFormat pixelFormat, const HostWindow*)
+{
+    IntSize backendSize = calculateBackendSize(size, resolutionScale);
+    if (backendSize.isEmpty())
+        return nullptr;
+
+    auto surface = IOSurface::create(backendSize, backendSize, cachedCGColorSpace(colorSpace), IOSurface::formatForPixelFormat(pixelFormat));
+    if (!surface)
+        return nullptr;
+
+    RetainPtr<CGContextRef> cgContext = surface->ensurePlatformContext();
+    if (!cgContext)
+        return nullptr;
+
+    CGContextClearRect(cgContext.get(), FloatRect(FloatPoint::zero(), backendSize));
+
+    return makeUnique<ImageBufferShareableMappedIOSurfaceBackend>(size, backendSize, resolutionScale, colorSpace, pixelFormat, WTFMove(surface));
+}
+
+std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> ImageBufferShareableMappedIOSurfaceBackend::create(const FloatSize& logicalSize, const IntSize& internalSize, float resolutionScale, ColorSpace colorSpace, PixelFormat pixelFormat, ImageBufferBackendHandle handle)
+{
+    if (!WTF::holds_alternative<MachSendRight>(handle)) {
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    auto surface = IOSurface::createFromSendRight(WTFMove(WTF::get<MachSendRight>(handle)), cachedCGColorSpace(colorSpace));
+    if (!surface)
+        return nullptr;
+
+    return makeUnique<ImageBufferShareableMappedIOSurfaceBackend>(logicalSize, internalSize, resolutionScale, colorSpace, pixelFormat, WTFMove(surface));
+}
+
+ImageBufferBackendHandle ImageBufferShareableMappedIOSurfaceBackend::createImageBufferBackendHandle() const
+{
+    return ImageBufferBackendHandle(m_surface->createSendRight());
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(GPU_PROCESS) && HAVE(IOSURFACE)
diff --git a/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.h b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.h
new file mode 100644
index 0000000..2a66bb3
--- /dev/null
+++ b/Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2020 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(GPU_PROCESS) && HAVE(IOSURFACE)
+
+#include "ImageBufferBackendHandle.h"
+#include <WebCore/ImageBufferIOSurfaceBackend.h>
+#include <wtf/IsoMalloc.h>
+
+namespace WebKit {
+
+class ShareableBitmap;
+
+class ImageBufferShareableMappedIOSurfaceBackend final : public WebCore::ImageBufferIOSurfaceBackend {
+    WTF_MAKE_ISO_ALLOCATED(ImageBufferShareableMappedIOSurfaceBackend);
+    WTF_MAKE_NONCOPYABLE(ImageBufferShareableMappedIOSurfaceBackend);
+public:
+    static std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> create(const WebCore::FloatSize& logicalSize, const float resolutionScale, WebCore::ColorSpace, WebCore::PixelFormat, const WebCore::HostWindow*);
+    static std::unique_ptr<ImageBufferShareableMappedIOSurfaceBackend> create(const WebCore::FloatSize& logicalSize, const WebCore::IntSize& internalSize, float resolutionScale, WebCore::ColorSpace, WebCore::PixelFormat, ImageBufferBackendHandle);
+
+    using WebCore::ImageBufferIOSurfaceBackend::ImageBufferIOSurfaceBackend;
+
+    ImageBufferBackendHandle createImageBufferBackendHandle() const;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(GPU_PROCESS) && HAVE(IOSURFACE)