Bug 250558
| Summary: | texSubImage2D crashed on iOS16 + WebGL2 + large WASM memory | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | fuyoucheng |
| Component: | WebGL | Assignee: | Kimmo Kinnunen <kkinnunen> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | dino, kbr, kkinnunen, ruba.merza, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Local Build | ||
| Hardware: | iPhone / iPad | ||
| OS: | iOS 16 | ||
fuyoucheng
How to reproduce:
1. Create a new Untiy WebGL project with an empty scene,
2. Set graphic api to WebGL2，
3. Set WASM initial memory to a large size (by adding "-s TOTAL_MEMORY=768MB" to PlayerSettings.WebGL.emscriptenArgs)
4. Build and load with Safari on iPhone12 with iOS16,
5. Safari report error when loading.
Rootcause:
Unity called texSubImage2D during initialization, Safari report error when invoking this api due to insufficient memory.
But that texture is 4*4 RGBA UNSIGNED_BYTE, should not cause any memory pressure.
When looking into WebGL2RenderingContext::texSubImage2D in WebKit source code, we found:
In WebGLRenderingContextBase::texImageArrayBufferViewHelper, variable 'data' created by WebGLRenderingContextBase::validateTexFuncData has incorrect value.
data.m_bufSize ought to be pixel data length, but acturally assigned as arrayBuffer(whole WASM memory) length - pixel data offset, which is much more larger.
Then later in IPC::Encoder::encodeFixedLengthData, encoder buffer will grow by this large size and lead to memory issue.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/104305743>
Kimmo Kinnunen
*** Bug 250862 has been marked as a duplicate of this bug. ***
Kimmo Kinnunen
See bug 250558 for a test case
Kimmo Kinnunen
Pull request: https://github.com/WebKit/WebKit/pull/9451
EWS
Committed 259742@main (905fdd75fe5d): <https://commits.webkit.org/259742@main>
Reviewed commits have been landed. Closing PR #9451 and removing active labels.
Kimmo Kinnunen
The fix shipped in iOS 16.4, macOS 12.3, Safari 16.4