Bug 250862 - REGRESSION(?): validateTexFuncData is getting passed the entire WASM ArrayBuffer instead of the texture buffer
Summary: REGRESSION(?): validateTexFuncData is getting passed the entire WASM ArrayBuf...
Status: RESOLVED DUPLICATE of bug 250558
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebGL (show other bugs)
Version: Safari 16
Hardware: Unspecified Unspecified
: P2 Major
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-01-19 14:13 PST by Ruba Merza
Modified: 2023-02-01 00:38 PST (History)
6 users (show)

See Also:


Attachments
Unity build that breaks on iOS 16.2 (4.90 MB, application/zip)
2023-01-19 14:13 PST, Ruba Merza
no flags Details
screenshot showing the bytelength returned (249.14 KB, image/png)
2023-01-19 14:13 PST, Ruba Merza
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ruba Merza 2023-01-19 14:13:16 PST
Created attachment 464566 [details]
Unity build that breaks on iOS 16.2

We've observed Unity WebGL applications crashing during loading in iOS 16. 

We did some investigating and found that in Webkit's WebGLRenderingContextBase::validateTexFuncData() function, the byteLength being returned is the WASM heap size and not the image size when using the WebGL2 srcOffset variant of glTexSubImage2D, which we believe is the cause of the memory issue that's then crashing the Unity application.

I'm attaching a project where we've set the Total Memory to 768 MB, and it immediately crashes on Safari in iOS 16.2, as well as a screenshot showing byteLength returning the size of the WASM array buffer.
Comment 1 Ruba Merza 2023-01-19 14:13:43 PST
Created attachment 464567 [details]
screenshot showing the bytelength returned
Comment 2 Alexey Proskuryakov 2023-01-19 19:05:57 PST
Thank you for the report! Could you please confirm when this worked?
Comment 3 Radar WebKit Bug Importer 2023-01-19 19:06:36 PST
<rdar://problem/104457648>
Comment 4 Brendan Duncan 2023-01-20 15:27:18 PST
Hi Alexey,

I don't believe this is a regression in WebGL2, but a regression from WebGL1 to WebGL2. WebGL2 has the new variant of texSubImage2D that takes the WASM heap pointer and a srcOffset to the texture data. This is the variant that is reporting too much memory for the texture.

In WebGLRenderingContextBase::validateTexFuncData, it returns byteLength, which it gets from pixels->byteLength(). byteLength is getting adjusted by srcOffset. However, pixels is still a view to the entire heap, so byteLength will be heapSize - srcOffset. From our understanding, this is causing even a small texture to report needing a large amount of memory.
Comment 5 Kimmo Kinnunen 2023-02-01 00:38:28 PST
I think this is duplicate of bug 250558

*** This bug has been marked as a duplicate of bug 250558 ***