Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c3e5fd593a0430f64660069de186b0ced147748d
https://github.com/WebKit/WebKit/commit/c3e5fd593a0430f64660069de186b0ced147748d
Author: Nikolas Zimmermann <[email protected]>
Date: 2026-04-24 (Fri, 24 Apr 2026)
Changed paths:
M Source/WebCore/platform/graphics/gbm/MemoryMappedGPUBuffer.cpp
M Source/WebCore/platform/graphics/gbm/MemoryMappedGPUBuffer.h
Log Message:
-----------
[Skia][GBM] Fix assertion in SkiaGPUAtlas::uploadImage(), trying to obtain a
MemoryMappedGPUBuffer WriteScope
https://bugs.webkit.org/show_bug.cgi?id=313171
Reviewed by Carlos Garcia Campos.
Extract the CPUMapping FD export out of MemoryMappedGPUBuffer::create()
into a new exportFDForMappingFromGBMBufferObject() helper, mirroring
the existing createDMABufFromGBMBufferObject(), and invoke it *before*
createDMABufFromGBMBufferObject().
The kernel caches the dma-buf object per gem-handle on the first
export and locks its mode flags for the lifetime of that cache entry.
Older Mesas (the issue reproduces on Raspberry Pi 5 with Mesa 25.02)
call gbm_bo_get_fd_for_plane() without DRM_RDWR, so if
createDMABufFromGBMBufferObject() ran first, the kernel would cache
the dma-buf as read-only. Every subsequent FD -- including the
DRMSystemCall RDWR fallback we use for mapping -- would then alias
that cached read-only object and bail on mmap(PROT_WRITE).
Running the RDWR export first ensures the kernel caches the dma-buf
with DRM_RDWR, and the later gbm_bo_get_fd_for_plane() call in
createDMABufFromGBMBufferObject() receives an FD backed by that same
RDWR-capable object.
Not testable on CI.
* Source/WebCore/platform/graphics/gbm/MemoryMappedGPUBuffer.cpp:
(WebCore::MemoryMappedGPUBuffer::create):
(WebCore::MemoryMappedGPUBuffer::exportFDForMappingFromGBMBufferObject):
* Source/WebCore/platform/graphics/gbm/MemoryMappedGPUBuffer.h:
Canonical link: https://commits.webkit.org/311927@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
