Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[GPU Process] REGRESSION: display-p3 stroke color in canvas crashes the webpage #19383

Conversation

shallawa
Copy link
Contributor

@shallawa shallawa commented Oct 21, 2023

922c037

[GPU Process] REGRESSION: display-p3 stroke color in canvas crashes the webpage
https://bugs.webkit.org/show_bug.cgi?id=263387
rdar://117226767

Reviewed by Simon Fraser.

Recording the inline path data items is enabled only if the state stroke has an
inline color or if the stroke color was not changed since last time the state was
committed.

A crash will happen when the current stroke color is not inline (display-p3 for
example) and it has been committed to the destination context in GPUP but the
stroke thickness was changed. The item SetInlineStrokeColor tries to get the
inline data a non inline color although the current stroke color is not inline
and it has not changed. So the crash happens.

The fix is to merge the inline stroke changes into one DisplayList item named
SetInlineStroke. It has two optional members: the inline color data and the
thickness. Each member will be set only if it was changed since last commit.

For representing the color in SetInlineStroke, PackedColor::RGBA will be used
instead of SRGBA<uint8_t> since it is easier to be encoded.

* LayoutTests/fast/canvas/canvas-line-no-change-display-p3-stroke-expected.html: Added.
* LayoutTests/fast/canvas/canvas-line-no-change-display-p3-stroke.html: Added.
* Source/WebCore/platform/graphics/Color.h:
(WebCore::Color::tryGetAsPackedInline const):
* Source/WebCore/platform/graphics/displaylists/DisplayListItem.h:
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp:
(WebCore::DisplayList::SetInlineStroke::apply const):
(WebCore::DisplayList::SetInlineStroke::dump const):
(WebCore::DisplayList::SetInlineStrokeColor::apply const): Deleted.
(WebCore::DisplayList::SetInlineStrokeColor::dump const): Deleted.
(WebCore::DisplayList::SetStrokeThickness::apply const): Deleted.
(WebCore::DisplayList::SetStrokeThickness::dump const): Deleted.
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.h:
(WebCore::DisplayList::SetInlineFillColor::SetInlineFillColor):
(WebCore::DisplayList::SetInlineFillColor::color const):
(WebCore::DisplayList::SetInlineFillColor::colorData const):
(WebCore::DisplayList::SetInlineStroke::SetInlineStroke):
(WebCore::DisplayList::SetInlineStroke::color const):
(WebCore::DisplayList::SetInlineStroke::colorData const):
(WebCore::DisplayList::SetInlineStroke::thickness const):
(WebCore::DisplayList::SetInlineStrokeColor::SetInlineStrokeColor): Deleted.
(WebCore::DisplayList::SetInlineStrokeColor::color const): Deleted.
(WebCore::DisplayList::SetInlineStrokeColor::colorData const): Deleted.
(WebCore::DisplayList::SetStrokeThickness::SetStrokeThickness): Deleted.
(WebCore::DisplayList::SetStrokeThickness::thickness const): Deleted.
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.cpp:
(WebCore::DisplayList::Recorder::appendStateChangeItem):
(WebCore::DisplayList::Recorder::buildSetInlineStroke):
(WebCore::DisplayList::Recorder::strokePath):
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.h:
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.cpp:
(WebCore::DisplayList::RecorderImpl::recordSetInlineFillColor):
(WebCore::DisplayList::RecorderImpl::recordSetInlineStroke):
(WebCore::DisplayList::RecorderImpl::recordStrokeLineWithColorAndThickness):
(WebCore::DisplayList::RecorderImpl::recordSetInlineStrokeColor): Deleted.
(WebCore::DisplayList::RecorderImpl::recordSetStrokeThickness): Deleted.
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.h:
* Source/WebKit/GPUProcess/graphics/RemoteDisplayListRecorder.cpp:
(WebKit::RemoteDisplayListRecorder::setInlineFillColor):
(WebKit::RemoteDisplayListRecorder::setInlineStroke):
(WebKit::RemoteDisplayListRecorder::strokeLineWithColorAndThickness):
(WebKit::RemoteDisplayListRecorder::setInlineStrokeColor): Deleted.
(WebKit::RemoteDisplayListRecorder::setStrokeThickness): Deleted.
* Source/WebKit/GPUProcess/graphics/RemoteDisplayListRecorder.h:
* Source/WebKit/GPUProcess/graphics/RemoteDisplayListRecorder.messages.in:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.cpp:
(WebKit::RemoteDisplayListRecorderProxy::recordSetInlineFillColor):
(WebKit::RemoteDisplayListRecorderProxy::recordSetInlineStroke):
(WebKit::RemoteDisplayListRecorderProxy::recordStrokeLineWithColorAndThickness):
(WebKit::RemoteDisplayListRecorderProxy::recordSetInlineStrokeColor): Deleted.
(WebKit::RemoteDisplayListRecorderProxy::recordSetStrokeThickness): Deleted.
* Source/WebKit/WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.h:
* Tools/TestWebKitAPI/Tests/WebCore/DisplayListTests.cpp:
(TestWebKitAPI::TEST):
* Tools/TestWebKitAPI/Tests/WebCore/cg/DisplayListTestsCG.cpp:
(TestWebKitAPI::TEST):

Canonical link: https://commits.webkit.org/269664@main

aa1dc22

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🛠 gtk
✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🧪 gtk-wk2
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🧪 api-gtk
✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress
✅ 🛠 🧪 merge ✅ 🛠 watch
✅ 🛠 watch-sim

@shallawa shallawa requested a review from cdumez as a code owner October 21, 2023 00:05
@shallawa shallawa self-assigned this Oct 21, 2023
@shallawa shallawa added the Canvas Bugs related to the canvas element. label Oct 21, 2023
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 21, 2023
@shallawa shallawa removed the merging-blocked Applied to prevent a change from being merged label Oct 21, 2023
@shallawa shallawa force-pushed the eng/GPU-Process-REGRESSION-display-p3-stroke-color-in-canvas-crashes-the-webpage branch from b970fd8 to 276ed08 Compare October 21, 2023 06:19
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 21, 2023
@shallawa shallawa removed the merging-blocked Applied to prevent a change from being merged label Oct 22, 2023
@shallawa shallawa force-pushed the eng/GPU-Process-REGRESSION-display-p3-stroke-color-in-canvas-crashes-the-webpage branch from 276ed08 to aa1dc22 Compare October 22, 2023 04:54
Color color() const { return { m_colorData }; }
const SRGBA<uint8_t>& colorData() const { return m_colorData; }
SetInlineFillColor(SRGBA<uint8_t> colorData)
: m_colorData(*Color(colorData).tryGetAsPackedInline())
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bouncing between SRGBA<uint8_t>, Color and PackedColor::RGBA doesn't seem great.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes this is correct. I think we should have a direct conversion from SRGBA<uint8_t> to PackedColor::RGBA. We need the opposite of SRGBA<uint8_t> asSRGBA(PackedColor::RGBA color). I will address this in a separate patch.

@shallawa shallawa added the merge-queue Applied to send a pull request to merge-queue label Oct 23, 2023
…he webpage

https://bugs.webkit.org/show_bug.cgi?id=263387
rdar://117226767

Reviewed by Simon Fraser.

Recording the inline path data items is enabled only if the state stroke has an
inline color or if the stroke color was not changed since last time the state was
committed.

A crash will happen when the current stroke color is not inline (display-p3 for
example) and it has been committed to the destination context in GPUP but the
stroke thickness was changed. The item SetInlineStrokeColor tries to get the
inline data a non inline color although the current stroke color is not inline
and it has not changed. So the crash happens.

The fix is to merge the inline stroke changes into one DisplayList item named
SetInlineStroke. It has two optional members: the inline color data and the
thickness. Each member will be set only if it was changed since last commit.

For representing the color in SetInlineStroke, PackedColor::RGBA will be used
instead of SRGBA<uint8_t> since it is easier to be encoded.

* LayoutTests/fast/canvas/canvas-line-no-change-display-p3-stroke-expected.html: Added.
* LayoutTests/fast/canvas/canvas-line-no-change-display-p3-stroke.html: Added.
* Source/WebCore/platform/graphics/Color.h:
(WebCore::Color::tryGetAsPackedInline const):
* Source/WebCore/platform/graphics/displaylists/DisplayListItem.h:
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp:
(WebCore::DisplayList::SetInlineStroke::apply const):
(WebCore::DisplayList::SetInlineStroke::dump const):
(WebCore::DisplayList::SetInlineStrokeColor::apply const): Deleted.
(WebCore::DisplayList::SetInlineStrokeColor::dump const): Deleted.
(WebCore::DisplayList::SetStrokeThickness::apply const): Deleted.
(WebCore::DisplayList::SetStrokeThickness::dump const): Deleted.
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.h:
(WebCore::DisplayList::SetInlineFillColor::SetInlineFillColor):
(WebCore::DisplayList::SetInlineFillColor::color const):
(WebCore::DisplayList::SetInlineFillColor::colorData const):
(WebCore::DisplayList::SetInlineStroke::SetInlineStroke):
(WebCore::DisplayList::SetInlineStroke::color const):
(WebCore::DisplayList::SetInlineStroke::colorData const):
(WebCore::DisplayList::SetInlineStroke::thickness const):
(WebCore::DisplayList::SetInlineStrokeColor::SetInlineStrokeColor): Deleted.
(WebCore::DisplayList::SetInlineStrokeColor::color const): Deleted.
(WebCore::DisplayList::SetInlineStrokeColor::colorData const): Deleted.
(WebCore::DisplayList::SetStrokeThickness::SetStrokeThickness): Deleted.
(WebCore::DisplayList::SetStrokeThickness::thickness const): Deleted.
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.cpp:
(WebCore::DisplayList::Recorder::appendStateChangeItem):
(WebCore::DisplayList::Recorder::buildSetInlineStroke):
(WebCore::DisplayList::Recorder::strokePath):
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.h:
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.cpp:
(WebCore::DisplayList::RecorderImpl::recordSetInlineFillColor):
(WebCore::DisplayList::RecorderImpl::recordSetInlineStroke):
(WebCore::DisplayList::RecorderImpl::recordStrokeLineWithColorAndThickness):
(WebCore::DisplayList::RecorderImpl::recordSetInlineStrokeColor): Deleted.
(WebCore::DisplayList::RecorderImpl::recordSetStrokeThickness): Deleted.
* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.h:
* Source/WebKit/GPUProcess/graphics/RemoteDisplayListRecorder.cpp:
(WebKit::RemoteDisplayListRecorder::setInlineFillColor):
(WebKit::RemoteDisplayListRecorder::setInlineStroke):
(WebKit::RemoteDisplayListRecorder::strokeLineWithColorAndThickness):
(WebKit::RemoteDisplayListRecorder::setInlineStrokeColor): Deleted.
(WebKit::RemoteDisplayListRecorder::setStrokeThickness): Deleted.
* Source/WebKit/GPUProcess/graphics/RemoteDisplayListRecorder.h:
* Source/WebKit/GPUProcess/graphics/RemoteDisplayListRecorder.messages.in:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.cpp:
(WebKit::RemoteDisplayListRecorderProxy::recordSetInlineFillColor):
(WebKit::RemoteDisplayListRecorderProxy::recordSetInlineStroke):
(WebKit::RemoteDisplayListRecorderProxy::recordStrokeLineWithColorAndThickness):
(WebKit::RemoteDisplayListRecorderProxy::recordSetInlineStrokeColor): Deleted.
(WebKit::RemoteDisplayListRecorderProxy::recordSetStrokeThickness): Deleted.
* Source/WebKit/WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.h:
* Tools/TestWebKitAPI/Tests/WebCore/DisplayListTests.cpp:
(TestWebKitAPI::TEST):
* Tools/TestWebKitAPI/Tests/WebCore/cg/DisplayListTestsCG.cpp:
(TestWebKitAPI::TEST):

Canonical link: https://commits.webkit.org/269664@main
@webkit-commit-queue webkit-commit-queue force-pushed the eng/GPU-Process-REGRESSION-display-p3-stroke-color-in-canvas-crashes-the-webpage branch from aa1dc22 to 922c037 Compare October 23, 2023 20:47
@webkit-commit-queue
Copy link
Collaborator

Committed 269664@main (922c037): https://commits.webkit.org/269664@main

Reviewed commits have been landed. Closing PR #19383 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit 922c037 into WebKit:main Oct 23, 2023
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Oct 23, 2023
@shallawa shallawa deleted the eng/GPU-Process-REGRESSION-display-p3-stroke-color-in-canvas-crashes-the-webpage branch December 15, 2023 17:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Canvas Bugs related to the canvas element.
Projects
None yet
5 participants