286664 2025-01-28 20:51:57 -0800 REGRESSION(241230@main): [cairo] convertImagePixels copies wrongly if source.format.alphaFormat == destination.format.alphaFormat && source.format.pixelFormat == destination.format.pixelFormat 2025-01-29 12:59:14 -0800 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=229665 InRadar P2 Normal --- 1 fujii fujii webkit-bug-importer oldest_to_newest 2090357 0 fujii 2025-01-28 20:51:57 -0800 While creating an API test of `convertImagePixels`, I found out a bug in `convertImagePixels`. https://github.com/WebKit/WebKit/blob/53ee544dee9b8fc6610d0ce70f23c673804bbd03/Source/WebCore/platform/graphics/PixelBufferConversion.cpp#L318-L321 > if (source.format.alphaFormat == destination.format.alphaFormat && source.format.pixelFormat == destination.format.pixelFormat) { > memcpySpan(destination.rows, source.rows.first(source.bytesPerRow * destinationSize.height())); > return; > } This code doesn't take destinationSize into account. Also, if source.bytesPerRow != destination.bytesPerRow, this code doesn't work. This code was added by 241230@main. 2090358 1 fujii 2025-01-28 20:57:58 -0800 I'm observing an assertion failure in the fast code path for my new API test. ASSERTION FAILED: destination.size() >= source.size() C:\webkit\wb\WebKitBuild\Debug\WTF\Headers\wtf/StdLibExtras.h(1036) : void WTF::memcpySpan(std::span<T, TExtent>, std::span<U, UExtent>) [T = unsigned char, TExtent = 18446744073709551615ULL, U = const unsigned char, UExtent = 18446744073709551615ULL] 1 00007FFAE51F3FE1 WTF::memcpySpan<unsigned char,18446744073709551615,const unsigned char,18446744073709551615> 2 00007FFAE97F6D4C WebCore::convertImagePixels 3 00007FF67D0A2A47 TestWebKitAPI::PixelBufferConversionTests_convertImagePixels2_Test::TestBody::<lambda_0>::operator() 4 00007FF67D0A25F7 TestWebKitAPI::PixelBufferConversionTests_convertImagePixels2_Test::TestBody 5 00007FF67D193FE0 testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test,void> 6 00007FF67D16C86A testing::internal::HandleExceptionsInMethodIfSupported<testing::Test,void> 7 00007FF67D154A63 testing::Test::Run 8 00007FF67D1552A6 testing::TestInfo::Run 9 00007FF67D155942 testing::TestSuite::Run 10 00007FF67D15F644 testing::internal::UnitTestImpl::RunAllTests 11 00007FF67D1950F0 testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl,bool> 12 00007FF67D16E4AA testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl,bool> 13 00007FF67D15F20E testing::UnitTest::Run 14 00007FF67CF76821 RUN_ALL_TESTS 15 00007FF67CF76702 TestWebKitAPI::TestsController::run 16 00007FF67D12515D main 17 00007FF67D196F00 __scrt_common_main_seh 18 00007FFBFC96259D BaseThreadInitThunk 19 00007FFBFCF4AF38 RtlUserThreadStart 2090361 2 fujii 2025-01-28 21:36:57 -0800 Pull request: https://github.com/WebKit/WebKit/pull/39673 2090509 3 ews-feeder 2025-01-29 12:58:53 -0800 Committed 289520@main (1de35d8ca5de): <https://commits.webkit.org/289520@main> Reviewed commits have been landed. Closing PR #39673 and removing active labels. 2090510 4 webkit-bug-importer 2025-01-29 12:59:14 -0800 <rdar://problem/143841035>