Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e594530ffc4e33eb0871a0a16e49ac89e8b2fe5b
https://github.com/WebKit/WebKit/commit/e594530ffc4e33eb0871a0a16e49ac89e8b2fe5b
Author: Matt Woodrow <[email protected]>
Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/image-bitmap-over-message-port-to-cross-site-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/image-bitmap-over-message-port-to-cross-site-iframe.html
A
LayoutTests/http/tests/site-isolation/image-bitmap-transfer-to-cross-site-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/image-bitmap-transfer-to-cross-site-iframe.html
A
LayoutTests/http/tests/site-isolation/resources/image-bitmap-draw-and-ack.html
A
LayoutTests/http/tests/site-isolation/resources/image-bitmap-over-message-port-and-ack.html
M Source/WebCore/Headers.cmake
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/bindings/js/SerializedScriptValue.cpp
M Source/WebCore/bindings/js/SerializedScriptValue.h
M Source/WebCore/bindings/js/SerializedScriptValueInternals.h
M Source/WebCore/html/ImageBitmap.cpp
M Source/WebCore/html/ImageBitmap.h
M Source/WebCore/page/Chrome.cpp
M Source/WebCore/page/Chrome.h
M Source/WebCore/page/ChromeClient.h
M Source/WebCore/platform/GraphicsClient.h
M Source/WebCore/platform/graphics/ImageBuffer.cpp
M Source/WebCore/platform/graphics/ImageBuffer.h
A Source/WebCore/platform/graphics/ImageBufferTransferIdentifier.h
M Source/WebKit/GPUProcess/GPUProcess.cpp
M Source/WebKit/GPUProcess/GPUProcess.h
M Source/WebKit/GPUProcess/GPUProcess.messages.in
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/Scripts/webkit/messages.py
M Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp
M Source/WebKit/Shared/ProcessQualified.serialization.in
M Source/WebKit/Shared/WTFArgumentCoders.serialization.in
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.cpp
M Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h
M Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
M Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
M Source/WebKit/WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.h
M Source/WebKit/WebProcess/WebProcess.cpp
Log Message:
-----------
[Site Isolation] Let a SerializedImageBuffer cross a process boundary, so
ImageBitmap can be transferred to a cross-site iframe
https://bugs.webkit.org/show_bug.cgi?id=314625
rdar://177413559
Reviewed by Kimmo Kinnunen.
Transferring an ImageBitmap to a cross-site iframe silently fails because
SerializedScriptValueInternals::detachedImageBitmaps was marked [NotSerialized].
Extends the existing GPU process RemoteRenderingBackend ImageBuffer transfer
mechanism to also support cross-process transfers using a new process-qualified
ImageBufferTransferIdentifier.
The send requests the buffer be moved to the GPU process global heap, the UI
process then handles changing the owning process, and then the receiving process
can transfer the buffer into its own RemoteRenderingBackend.
MessagePorts go through the Network process, so that bounces through the UI
process before following the same path as postMessage.
New tests added for both postMessage and MessagePort variants.
Still fails silently if the ImageBitmap contains a local image, instead of a
RemoteImageBufferProxy.
*
LayoutTests/http/tests/site-isolation/image-bitmap-over-message-port-to-cross-site-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/image-bitmap-over-message-port-to-cross-site-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/image-bitmap-transfer-to-cross-site-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/image-bitmap-transfer-to-cross-site-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/image-bitmap-draw-and-ack.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/image-bitmap-over-message-port-and-ack.html:
Added.
* Source/WebCore/Headers.cmake:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
(WebCore::SerializedScriptValueInternals::clone const):
(WebCore::SerializedScriptValue::sinkBuffersIntoTransferHandles): Sinks every
transferable
buffer in the value into a handle; called before a cross-process send.
(WebCore::SerializedScriptValue::transferredImageBufferIdentifiers const): Lets
the UI
process authorize the recipient.
(WebCore::SerializedScriptValue::create):
* Source/WebCore/bindings/js/SerializedScriptValue.h:
* Source/WebCore/bindings/js/SerializedScriptValueInternals.h: Moved
detachedImageBitmaps
into the contiguous run of serialized members, which the generated aggregate
initialization
requires.
* Source/WebCore/html/ImageBitmap.cpp:
(WebCore::DetachedImageBitmap::DetachedImageBitmap):
(WebCore::DetachedImageBitmap::sinkBufferIntoTransferHandle):
(WebCore::DetachedImageBitmap::memoryCost const):
(WebCore::ImageBitmap::create): Returns RefPtr, since claiming a parked buffer
can fail.
* Source/WebCore/html/ImageBitmap.h:
(WebCore::DetachedImageBitmap::originClean const):
(WebCore::DetachedImageBitmap::premultiplyAlpha const):
(WebCore::DetachedImageBitmap::forciblyPremultiplyAlpha const):
(WebCore::DetachedImageBitmap::bufferAlphaFormat const):
* Source/WebCore/page/Chrome.cpp:
(WebCore::Chrome::createImageBufferFromTransferHandle):
* Source/WebCore/page/Chrome.h:
* Source/WebCore/page/ChromeClient.h:
(WebCore::ChromeClient::createImageBufferFromTransferHandle):
* Source/WebCore/platform/GraphicsClient.h:
* Source/WebCore/platform/graphics/ImageBuffer.cpp:
(WebCore::SerializedImageBuffer::sinkIntoTransferHandle):
(WebCore::ImageBuffer::createFromTransferHandle):
* Source/WebCore/platform/graphics/ImageBuffer.h:
(WebCore::SerializedImageBuffer::sinkIntoTransferHandle):
* Source/WebCore/platform/graphics/ImageBufferTransferIdentifier.h: Added.
* Source/WebKit/GPUProcess/GPUProcess.cpp:
(WebKit::GPUProcess::removeGPUConnectionToWebProcess):
(WebKit::GPUProcess::authorizeImageBufferTransfers):
(WebKit::GPUProcess::takeSettledImageBufferTransferAuthorizations):
(WebKit::GPUProcess::depositTransferredImageBuffer):
(WebKit::GPUProcess::takeTransferredImageBuffer):
(WebKit::GPUProcess::removeTransferredImageBuffersForProcess):
* Source/WebKit/GPUProcess/GPUProcess.h:
* Source/WebKit/GPUProcess/GPUProcess.messages.in:
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::moveToImageBuffer):
(WebKit::RemoteRenderingBackend::moveSerializedBufferToTransferHeap):
(WebKit::RemoteRenderingBackend::takeTransferredBuffer):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h:
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::takeAllMessagesForPort): Has the UI
process hand
ownership to the authenticated recipient before releasing the messages to it.
* Source/WebKit/Scripts/webkit/messages.py:
(serialized_identifiers):
(types_that_cannot_be_forward_declared):
(headers_for_type):
* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:
(IPC::serializedIdentifiers):
* Source/WebKit/Shared/ProcessQualified.serialization.in:
* Source/WebKit/Shared/WTFArgumentCoders.serialization.in:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::authorizeImageBufferTransfers):
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::postMessageToRemote): Hands ownership to the destination
process and
waits for the GPU process before relaying the message.
* Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.cpp:
(WebKit::RemoteSerializedImageBufferProxy::RemoteSerializedImageBufferProxy):
(WebKit::RemoteSerializedImageBufferProxy::sinkIntoTransferHandle): Returns the
existing handle
when the buffer is already in the heap, since a relaying process decodes and
re-encodes these
messages.
* Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h:
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::moveSerializedBufferToTransferHeap):
(WebKit::RemoteRenderingBackendProxy::takeTransferredBuffer):
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::createImageBufferFromTransferHandle):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:
* Source/WebKit/WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp:
(WebKit::WebMessagePortChannelProvider::postMessageToRemote): Parks buffers on
the way to the
network process, but not on the in-process delivery path.
* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp:
(WebKit::WebRemoteFrameClient::postMessageToRemote):
* Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.cpp:
(WebKit::GPUProcessWebWorkerClient::createImageBufferFromTransferHandle):
(WebKit::WebWorkerClient::createImageBufferFromTransferHandle):
* Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.h:
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeProcess):
Canonical link: https://commits.webkit.org/321656@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
