Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e4b357a32b53a80abbb20db9fe9aa389e182b6b7
https://github.com/WebKit/WebKit/commit/e4b357a32b53a80abbb20db9fe9aa389e182b6b7
Author: Kiet Ho <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
A LayoutTests/fast/canvas/canvas-open-two-layers-then-gc-crash-expected.txt
A LayoutTests/fast/canvas/canvas-open-two-layers-then-gc-crash.html
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h
Log Message:
-----------
CanvasRenderingContext2DBase: always unwind state stack on destruction
rdar://181410211
https://bugs.webkit.org/show_bug.cgi?id=319288
Reviewed by Simon Fraser.
CanvasRenderingContext2DBase::beginLayer works by putting a new targetSwitcher
on the state stack, so the new effective drawing context will be the drawing
context of the new targetSwitcher. Then when endLayer is called, targetSwitcher
goes away, and its destructor paints the layer content to the previous effective
drawing context, which could be the base buffer (m_buffer), or the previous
targetSwitcher on the stack.
This means the targetSwitcher on the top of the stack paints to the next one on
the stack, ... until the last one paints to m_buffer. Consequently, the state
stack
has to be unwound from top to bottom of stack (last to first of vector) to
respect the dependency chain. The current destructor does this by repeatedly
calling restore(), but it's only enabled in Debug builds. In Release builds, the
default destructor is used, which frees the state stack in the WTF::Vector order
from first to last. The result is that freeing targetSwitcher might cause a
crash, as it paints to the previous targetSwitcher that's already freed.
Fix this by always unwinding the state stack properly on destruction, regardless
of Debug or Release builds.
Test: fast/canvas/canvas-open-two-layers-then-gc-crash.html
* LayoutTests/fast/canvas/canvas-open-two-layers-then-gc-crash-expected.txt:
Added.
* LayoutTests/fast/canvas/canvas-open-two-layers-then-gc-crash.html: Added.
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::~CanvasRenderingContext2DBase):
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:
Canonical link: https://commits.webkit.org/317787@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
