Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b23dfbcbb9cf9ba3a22ad0b7f7a55dd77f00b462
https://github.com/WebKit/WebKit/commit/b23dfbcbb9cf9ba3a22ad0b7f7a55dd77f00b462
Author: Tim Nguyen <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Source/WebCore/platform/graphics/cg/IOSurfacePool.cpp
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm
Log Message:
-----------
IOSurfacePool::tryEvictOldestCachedSurface should not dereference an end()
iterator
https://bugs.webkit.org/show_bug.cgi?id=318657
rdar://177969354
Reviewed by Simon Fraser.
IOSurfacePool keeps two parallel collections that must stay in sync:
m_cachedSurfaces (HashMap<IntSize, Deque<unique_ptr<IOSurface>>>) and
m_sizesInPruneOrder (Vector<IntSize>). tryEvictOldestCachedSurface()
looked up m_sizesInPruneOrder.first() in m_cachedSurfaces and dereferenced
the result without checking against end(). An MTE crashtracer in the GPU
process (RemoteRenderingBackend work queue, reached via ReleaseImageBufferSet
-> ~ImageBufferIOSurfaceBackend -> addSurface -> evict) shows the lookup
returning end() and the subsequent ->value.takeLast() reading one bucket past
the HashTable allocation, faulting on the first byte of the next allocation.
Early return in the case of the mismatch and clean up only one of the two
collections in that case.
Test: Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm
* Source/WebCore/platform/graphics/cg/IOSurfacePool.cpp:
(WebCore::IOSurfacePool::tryEvictOldestCachedSurface):
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm:
(TestWebKitAPI::createSurface):
(TestWebKitAPI::TEST(IOSurfacePoolTest, EvictionWithManyDistinctSizes)):
(TestWebKitAPI::TEST(IOSurfacePoolTest, ConcurrentAddAndEvict)):
Originally-landed-as: [email protected] (f6cebae3c564).
rdar://185369110
Canonical link: https://commits.webkit.org/320370@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
