Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ad056c8f508834087113e86119ef9b922886ab84
https://github.com/WebKit/WebKit/commit/ad056c8f508834087113e86119ef9b922886ab84
Author: Vitor Roriz <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
A LayoutTests/ipc/move-to-image-buffer-cross-thread-font-crash-expected.txt
A LayoutTests/ipc/move-to-image-buffer-cross-thread-font-crash.html
M LayoutTests/platform/glib/TestExpectations
M Source/WebCore/platform/graphics/FontCustomPlatformData.h
M Source/WebCore/platform/graphics/ImageBuffer.cpp
M Source/WebCore/platform/graphics/ImageBuffer.h
M Source/WebCore/platform/graphics/ImageBufferBackend.h
M Source/WebCore/platform/graphics/ImageBufferDisplayListBackend.cpp
M Source/WebCore/platform/graphics/ImageBufferDisplayListBackend.h
M Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp
M Source/WebCore/platform/graphics/displaylists/DisplayListItems.h
M Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.cpp
M Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.h
M Source/WebCore/platform/graphics/skia/SkiaHarfBuzzFont.h
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
Log Message:
-----------
Copy fonts when transferring a display list between RemoteRenderingBackends
https://bugs.webkit.org/show_bug.cgi?id=309793
rdar://169616107
Reviewed by Ryosuke Niwa, Zak Ridouh, and Brent Fulgham.
WebCore::Font uses non-thread-safe RefCounted. A DrawGlyphs display list item
holds
a Ref<const Font>, and a DisplayList-backed ImageBuffer can be transferred to
another
RemoteRenderingBackend, which runs on its own work-queue thread. After the
transfer
both threads run ref and deref on the same Font, which races the non-atomic
refcount
and leads to a use-after-free.
Making Font ThreadSafeRefCounted would require dropping its single-thread weak
pointers (e.g. GlyphPage weakly points back at its Font to break the
Font/GlyphPage
ownership cycle) in favor of strong references, which would change Font
lifetime:
fonts would retain each other and could no longer be purged.
Instead, when a display list is transferred, replace each Font it references
with the
data needed to rebuild it (its FontInternalAttributes and FontPlatformData) on
the
source backend thread, and rebuild the Font on the destination backend thread,
recursing into nested DrawDisplayList items. Font stamps its single-thread weak
pointer with the thread that constructs it, so rebuilding on the destination
keeps
each Font constructed, used and destroyed on a single thread. The rebuild data
holds
no single-thread state, and its FontPlatformData internals
(FontCustomPlatformData,
and on Skia SkiaHarfBuzzFont) are made ThreadSafeRefCounted, so it is safe to
move
across the two threads.
Separately, ImageBufferDisplayListBackend::copyNativeImage now replays through
the
backend own ControlFactory instead of the main-thread
ControlFactory::singleton(),
which is not safe to access off the main thread.
* Source/WebCore/platform/graphics/FontCustomPlatformData.h:
* Source/WebCore/platform/graphics/skia/SkiaHarfBuzzFont.h:
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.h:
(WebCore::DisplayList::DrawGlyphs::font):
(WebCore::DisplayList::DrawGlyphs::replaceFontWithRebuildData):
(WebCore::DisplayList::DrawGlyphs::rebuildFont):
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp:
(WebCore::DisplayList::DrawGlyphs::apply):
(WebCore::DisplayList::DrawDisplayList::setDisplayList):
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.h:
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.cpp:
(WebCore::DisplayList::RecorderImpl::replaceFontsWithRebuildData):
(WebCore::DisplayList::RecorderImpl::rebuildFonts):
* Source/WebCore/platform/graphics/ImageBuffer.h:
* Source/WebCore/platform/graphics/ImageBuffer.cpp:
(WebCore::ImageBuffer::replaceFontsWithRebuildData):
(WebCore::ImageBuffer::rebuildFonts):
* Source/WebCore/platform/graphics/ImageBufferBackend.h:
(WebCore::ImageBufferBackend::replaceFontsWithRebuildData):
(WebCore::ImageBufferBackend::rebuildFonts):
* Source/WebCore/platform/graphics/ImageBufferDisplayListBackend.h:
* Source/WebCore/platform/graphics/ImageBufferDisplayListBackend.cpp:
(WebCore::ImageBufferDisplayListBackend::copyNativeImage):
(WebCore::ImageBufferDisplayListBackend::replaceFontsWithRebuildData):
(WebCore::ImageBufferDisplayListBackend::rebuildFonts):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::moveToSerializedBuffer):
(WebKit::RemoteRenderingBackend::moveToImageBuffer):
* LayoutTests/ipc/move-to-image-buffer-cross-thread-font-crash.html: Added.
* LayoutTests/ipc/move-to-image-buffer-cross-thread-font-crash-expected.txt:
Added.
Canonical link: https://commits.webkit.org/317722@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
