REGRESSION(261130@main): Canvas putImageData draws onto wrong canvas

Created attachment 466149 [details]
demo of bug

Observed on:
- MacBook Air M1: MacOS 12.4 Safari 15.5, MacOS 13.3.1 Safari 16.4
- iPad 2019: iPadOS 15.4.1, iPadOS 16.4.1
- iPhone SE 2022: iOS 16.3
(non-WebKit browsers not affected)

Steps:
- Create 2 canvases: canvas A, and canvas B.
- Draw canvas A on canvas B.
- Create ImageData with any data (here it's noise).
- putImageData onto canvas A.

Expected:
- ImageData is only drawn onto canvas A.

Actual:
- It is also drawn on canvas B.

Demo page: https://bitbof.github.io/browser-bug-demos/2023-04-30-safari-putimagedata/

[Simon Fraser (smfr)]

I can reproduce (only when UI-side compositing is disabled).

[Radar WebKit Bug Importer]

<rdar://problem/108741153>

[Said Abou-Hallawa]

This is a regression of 261130@main. Commenting this if-statement in RemoteImageBufferProxy::putPixelBuffer() fixes the issue.

    if (canMapBackingStore()) {
        const_cast<RemoteImageBufferProxy&>(*this).flushDrawingContext();
        ImageBuffer::putPixelBuffer(pixelBuffer, srcRect, destPoint, destFormat);
        // Simulate a write so that read caches are cleared.
        // FIXME: This should not be done via the context draw, as that induces a flush.
        context().fillRect({ });
        return;
    }

[Kimmo Kinnunen]

Thanks for the investigation.
I'll fix it unless Said has started..

[Kimmo Kinnunen]

Pull request: https://github.com/WebKit/WebKit/pull/13689

[EWS]

Committed 263978@main (a658f97638bf): <https://commits.webkit.org/263978@main>

Reviewed commits have been landed. Closing PR #13689 and removing active labels.