Chrome · Skia › Skia
CVE-2026-17771
Uninitialized Memory in Skia (Skia)
Overview
Medium
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- `SkUserConfig.h`
- Chromium’s build-time configuration header for Skia;
#defines here switch Skia code paths on or off for all of Chrome, often to stage a behavior change that Skia lands behind a flag. - Bilinear (linear) texture sampling
- a filtered lookup that blends the 2x2 texels around the sample coordinate, so a sample near a subset edge can pull in texels just outside that subset.
- Shader clamp detection / inset
- Skia’s logic that decides whether a texture subset needs explicit in-shader coordinate clamping, by insetting the subset bounds (traditionally by half a texel) and checking whether all sample coordinates stay inside.
- Golden-image rebaseline
- updating expected pixel output (
*-expected.png,revision_number) in layout, viz, and ash pixel tests to absorb intentional rendering differences.
Root Cause Analysis
The only non-test change in this Chromium commit is adding
#define SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING to skia/config/SkUserConfig.h; the Skia code that the macro selects lives in the Skia repository and is not part of this diff. Per the commit message, the flag “changes the shader clamp detection to use an inset that is just shy of a full half pixel to prevent ambiguity in bilinear sampling landing on an exact pixel center.” Read together with the advisory (“Uninitialized Use in Skia”), the implied flaw is that with an exact half-texel inset, the clamp-detection test could conclude no clamping was needed while a bilinear sample at the subset boundary still had nonzero weight on the neighboring texel outside the valid subset, so texels that were never written (e.g. padding in a larger backing texture) could leak into the output (inferred). Using a slightly smaller-than-half inset removes that boundary ambiguity so such samples are routed to the clamping path; the many blur/filter golden-image rebaselines (effect-blur-hw, filter-occlusion-blur-large, bypass_texture_backdrop_extent.png, ash blur pixel tests, a loosened SetErrorPixelsPercentageLimit in renderer_pixeltest.cc) are consistent with sub-pixel output changes at subset edges, not with any further code fix.Key insight
Skia’s edge-of-subset clamp decision used an inset of exactly half a texel, which leaves bilinear samples that land on that boundary ambiguous and can let out-of-subset (potentially uninitialized) texels contribute; Chromium’s fix is to opt into Skia’s “safe inset” (just under half a texel) via
SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING.Attack Path
- Content draws a texture subset with linear filtering
web content triggers GPU rendering of an image or intermediate surface subset, with blur/backdrop filters being the cases exercised by the rebaselined tests (
effect-blur-hw,filter-occlusion-blur,bypass_texture_backdrop_extent). - Clamp detection skips clamping at the boundary
with the pre-flag half-texel inset, Skia’s clamp detection could judge the sample region safe even when bilinear sampling at an exact pixel center along the edge still touched the neighboring texel
(inferred from the commit message). - Out-of-subset texels contribute to output
those neighboring texels may be uninitialized backing-store memory, so stale data blends into rendered edge pixels
(inferred; the Skia-side code and any concrete leak are not in this diff). - Pixels become observable
if the affected output is readable by content (e.g. via canvas readback), uninitialized GPU memory contents could be disclosed
(inferred).
Impact Assessment
The advisory classifies this as Medium “Uninitialized Use in Skia” and does not report in-the-wild exploitation. The plausible impact is information disclosure of uninitialized texture memory through edge pixels of filtered/blurred draws in the GPU/raster path
(inferred); the Chromium diff demonstrates only a configuration flag flip and rendering rebaselines, not a memory-corruption primitive or a concrete leak, and the actual Skia code change is in Skia, not here.Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Fash/fullscreen_pixeltest.cc |
modified | |
LoginShelfWithPolicyWallpaperPixelTestWithRTLash/shelf/login_shelf_view_pixeltest.cc |
modified | |
TEST_Pash/shelf/scrollable_shelf_view_pixeltest.cc |
modified |
Files Changed
ash/app_list/views/app_list_view_pixeltest.ccash/fullscreen_pixeltest.ccash/shelf/login_shelf_view_pixeltest.ccash/shelf/scrollable_shelf_view_pixeltest.ccash/system/channel_indicator/channel_indicator_pixeltest.ccash/system/notification_center/views/ash_notification_view_pixeltest.ccash/system/toast/system_toast_view_pixeltest.ccash/system/video_conference/bubble/bubble_view_pixeltest.ccash/system/video_conference/video_conference_tray_pixeltest.cccomponents/test/data/viz/bypass_texture_backdrop_extent.pngcomponents/viz/service/display/renderer_pixeltest.cccontent/test/content_test_bundle_data.filelistcontent/test/gpu/gpu_tests/test_expectations/pixel_expectations.txtskia/config/SkUserConfig.hthird_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.pngthird_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.pngthird_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.pngthird_party/blink/web_tests/css3/filters/effect-blur-hw-expected.pngthird_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.pngthird_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.pngthird_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.pngthird_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.pngthird_party/blink/web_tests/css3/filters/filter-change-repaint-expected.pngthird_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.pngthird_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.pngthird_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.pngthird_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.pngthird_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.pngthird_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.pngthird_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.pngthird_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.pngthird_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.pngthird_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.pngthird_party/blink/web_tests/platform/linux/virtual/gpu-rasterization/images/color-profile-reflection-expected.pngthird_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.pngthird_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.pngthird_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.pngthird_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.pngthird_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.pngthird_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.pngthird_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.pngthird_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.pngthird_party/blink/web_tests/platform/mac-mac15-arm64/compositing/masks/mask-with-removed-filters-expected.pngthird_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.pngthird_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.pngthird_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.pngthird_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.pngthird_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.pngthird_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.pngthird_party/blink/web_tests/platform/mac/compositing/transform-3d-scales-different-x-y-expected.pngthird_party/blink/web_tests/platform/mac/css3/blending/background-blend-mode-overlapping-accelerated-elements-expected.pngthird_party/blink/web_tests/platform/mac/css3/filters/effect-brightness-clamping-hw-expected.pngthird_party/blink/web_tests/platform/mac/css3/filters/effect-combined-hw-expected.pngthird_party/blink/web_tests/platform/mac/css3/filters/effect-drop-shadow-hw-expected.pngthird_party/blink/web_tests/platform/mac/css3/filters/effect-reference-colorspace-hw-expected.pngthird_party/blink/web_tests/platform/mac/css3/filters/effect-reference-hw-expected.pngthird_party/blink/web_tests/platform/mac/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.pngthird_party/blink/web_tests/platform/mac/transforms/transformed-caret-expected.pngthird_party/blink/web_tests/platform/mac/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.pngthird_party/blink/web_tests/platform/mac/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.pngthird_party/blink/web_tests/platform/mac/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.pngthird_party/blink/web_tests/platform/mac/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.pngthird_party/blink/web_tests/platform/mac/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.pngthird_party/blink/web_tests/platform/mac/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.pngthird_party/blink/web_tests/platform/mac/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.pngthird_party/blink/web_tests/platform/mac/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.pngthird_party/blink/web_tests/platform/win/compositing/perspective-interest-rect-expected.pngthird_party/blink/web_tests/platform/win/compositing/transform-3d-scales-different-x-y-expected.pngthird_party/blink/web_tests/platform/win/css3/filters/effect-brightness-clamping-hw-expected.pngthird_party/blink/web_tests/platform/win/css3/filters/effect-combined-hw-expected.pngthird_party/blink/web_tests/platform/win/css3/filters/effect-drop-shadow-hw-expected.pngthird_party/blink/web_tests/platform/win/css3/filters/effect-reference-colorspace-hw-expected.pngthird_party/blink/web_tests/platform/win/css3/filters/effect-reference-hw-expected.pngthird_party/blink/web_tests/platform/win/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.pngthird_party/blink/web_tests/platform/win/virtual/exotic-color-space/images/optimize-contrast-canvas-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-blur-hw-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.pngthird_party/blink/web_tests/platform/win/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.pngthird_party/blink/web_tests/platform/win10/compositing/masks/mask-with-added-filters-expected.pngthird_party/blink/web_tests/platform/win10/compositing/masks/mask-with-removed-filters-expected.pngthird_party/blink/web_tests/platform/win10/compositing/perspective-interest-rect-expected.pngthird_party/blink/web_tests/platform/win10/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.pngthird_party/blink/web_tests/platform/win10/transforms/transformed-caret-expected.pngthird_party/blink/web_tests/platform/win10/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.pngthird_party/blink/web_tests/platform/win11-arm64/compositing/masks/mask-with-added-filters-expected.pngthird_party/blink/web_tests/platform/win11-arm64/compositing/masks/mask-with-removed-filters-expected.pngthird_party/blink/web_tests/platform/win11-arm64/css3/filters/effect-reference-colorspace-hw-expected.pngthird_party/blink/web_tests/platform/win11-arm64/transforms/transformed-caret-expected.pngthird_party/blink/web_tests/platform/win11-arm64/virtual/exotic-color-space/images/yuv-decode-eligible/color-profile-layer-filter-expected.pngthird_party/blink/web_tests/platform/win11-arm64/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.pngthird_party/blink/web_tests/platform/win11-arm64/virtual/scalefactor200/css3/filters/effect-all-on-background-hw-expected.pngthird_party/blink/web_tests/platform/win11-arm64/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.pngthird_party/blink/web_tests/platform/win11-arm64/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.pngthird_party/blink/web_tests/platform/win11-arm64/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.pngthird_party/blink/web_tests/virtual/exotic-color-space/images/optimize-contrast-image-expected.pngthird_party/blink/web_tests/virtual/exotic-color-space/images/yuv-decode-eligible/color-profile-layer-filter-expected.pngthird_party/blink/web_tests/virtual/scalefactor200/css3/filters/effect-all-on-background-hw-expected.pngthird_party/blink/web_tests/virtual/scalefactor200/css3/filters/effect-reference-ordering-hw-expected.pngthird_party/blink/web_tests/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.pngthird_party/blink/web_tests/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.png
Audit Directions
- Exact-half-texel boundary mathreview other subset/clamp decisions in Skia (
SkImageShader, Ganesh/Graphite texture effects,GrTextureEffect-style subset handling) for0.5finsets and<=/<comparisons where a sample on an exact pixel center is classified as “inside”. - Approx-fit and scratch texturesany path that renders into a backing texture larger than its logical content (blur intermediates, backdrop filters, tiled/atlas surfaces) must either clear the padding or force clamping; audit for missing clears where clamping is skipped.
- Behavior gated by config macroswhen a security fix is staged behind an
SK_*define, check every embedder config (Chromium, Android, Flutter, standalone Skia builds) actually sets it, and that the legacy path is removed.
Patch
diff --git a/ash/app_list/views/app_list_view_pixeltest.cc b/ash/app_list/views/app_list_view_pixeltest.cc
index 255d5d6d..637c063 100644
--- a/ash/app_list/views/app_list_view_pixeltest.cc
+++ b/ash/app_list/views/app_list_view_pixeltest.cc
@@ -192,7 +192,7 @@
UseFixedPlaceholderTextAndHideCursor(test_helper->GetSearchBoxView());
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("bubble_launcher_answer_card_search_results"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 19 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 20 : 1,
GetAppListTestHelper()->GetBubbleView(),
GetPrimaryShelf()->navigation_widget()));
}
@@ -215,7 +215,7 @@
UseFixedPlaceholderTextAndHideCursor(test_helper->GetSearchBoxView());
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("bubble_launcher_url_search_results"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 18 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 19 : 1,
GetAppListTestHelper()->GetBubbleView(),
GetPrimaryShelf()->navigation_widget()));
}
@@ -252,7 +252,7 @@
GetAppListTestHelper()->GetSearchBoxView());
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("bubble_launcher_basics"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 21 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 22 : 1,
GetAppListTestHelper()->GetBubbleView(),
GetPrimaryShelf()->navigation_widget()));
}
@@ -275,7 +275,7 @@
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("bubble_launcher_gradient_zone"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 21 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 22 : 1,
GetAppListTestHelper()->GetBubbleView(),
GetPrimaryShelf()->navigation_widget()));
}
@@ -291,7 +291,7 @@
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("bubble_launcher_gemini_button"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 4 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 5 : 1,
GetAppListTestHelper()->GetBubbleView(),
GetPrimaryShelf()->navigation_widget()));
}
diff --git a/ash/fullscreen_pixeltest.cc b/ash/fullscreen_pixeltest.cc
index 6871d105..3c2a3dc 100644
--- a/ash/fullscreen_pixeltest.cc
+++ b/ash/fullscreen_pixeltest.cc
@@ -23,7 +23,8 @@
// Verifies the primary fullscreen of an active user session.
TEST_F(FullscreenPixelTest, VerifyDefaultPrimaryDisplay) {
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "primary_display", /*revision_number=*/9, Shell::GetPrimaryRootWindow()));
+ "primary_display", /*revision_number=*/10,
+ Shell::GetPrimaryRootWindow()));
}
} // namespace ash
diff --git a/ash/shelf/login_shelf_view_pixeltest.cc b/ash/shelf/login_shelf_view_pixeltest.cc
index 4b0cba38..6ae7eab 100644
--- a/ash/shelf/login_shelf_view_pixeltest.cc
+++ b/ash/shelf/login_shelf_view_pixeltest.cc
@@ -68,29 +68,29 @@
aura::Window* primary_shelf_window = GetPrimaryShelf()->GetWindow();
PressAndReleaseKey(ui::VKEY_TAB);
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "focus_on_login_user_expand_button",
- /*revision_number=*/13, primary_big_user_view_.get(),
+ GenerateScreenshotName("focus_on_login_user_expand_button"),
+ /*revision_number=*/0, primary_big_user_view_.get(),
primary_shelf_window));
// Trigger the tab key. Check that the login shelf shutdown button is focused.
PressAndReleaseKey(ui::VKEY_TAB);
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "focus_on_shutdown_button",
- /*revision_number=*/13, primary_big_user_view_.get(),
+ GenerateScreenshotName("focus_on_shutdown_button"),
+ /*revision_number=*/0, primary_big_user_view_.get(),
primary_shelf_window));
// Trigger the tab key. Check that the browser as guest button is focused.
PressAndReleaseKey(ui::VKEY_TAB);
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "focus_on_browser_as_guest_button",
- /*revision_number=*/13, primary_big_user_view_.get(),
+ GenerateScreenshotName("focus_on_browser_as_guest_button"),
+ /*revision_number=*/0, primary_big_user_view_.get(),
primary_shelf_window));
// Trigger the tab key. Check that the add person button is focused.
PressAndReleaseKey(ui::VKEY_TAB);
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "focus_on_add_person_button",
- /*revision_number=*/13, primary_big_user_view_.get(),
+ GenerateScreenshotName("focus_on_add_person_button"),
+ /*revision_number=*/0, primary_big_user_view_.get(),
primary_shelf_window));
}
@@ -104,22 +104,22 @@
aura::Window* primary_shelf_window = GetPrimaryShelf()->GetWindow();
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "focus_on_calendar_view",
- /*revision_number=*/10, primary_shelf_window));
+ GenerateScreenshotName("focus_on_calendar_view"),
+ /*revision_number=*/0, primary_shelf_window));
// Focus on the time view.
PressAndReleaseKey(ui::VKEY_TAB);
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "focus_on_time_view.rev_0",
- /*revision_number=*/10, primary_shelf_window));
+ GenerateScreenshotName("focus_on_time_view.rev_0"),
+ /*revision_number=*/0, primary_shelf_window));
PressAndReleaseKey(ui::VKEY_TAB, ui::EF_SHIFT_DOWN);
PressAndReleaseKey(ui::VKEY_TAB, ui::EF_SHIFT_DOWN);
// Move the focus back to the add person button.
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "refocus_on_login_shelf",
- /*revision_number=*/10, primary_shelf_window));
+ GenerateScreenshotName("refocus_on_login_shelf"),
+ /*revision_number=*/0, primary_shelf_window));
}
class LoginShelfWithPolicyWallpaperPixelTestWithRTL
diff --git a/ash/shelf/scrollable_shelf_view_pixeltest.cc b/ash/shelf/scrollable_shelf_view_pixeltest.cc
index d3a6fe8..480ec659 100644
--- a/ash/shelf/scrollable_shelf_view_pixeltest.cc
+++ b/ash/shelf/scrollable_shelf_view_pixeltest.cc
@@ -52,7 +52,7 @@
TEST_P(ScrollableShelfViewPixelRTLTest, Basics) {
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("overflow"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 11 : 0,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 12 : 0,
GetPrimaryShelf()->GetWindow()));
ASSERT_TRUE(scrollable_shelf_view_->right_arrow());
@@ -64,7 +64,7 @@
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("overflow_end"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 11 : 0,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 12 : 0,
GetPrimaryShelf()->GetWindow()));
}
@@ -127,7 +127,7 @@
// Verify the shelf context menu and the shelf.
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("shelf_context_menu"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 25 : 0,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 26 : 0,
GetPrimaryShelf()
->shelf_widget()
->shelf_view_for_testing()
diff --git a/ash/system/channel_indicator/channel_indicator_pixeltest.cc b/ash/system/channel_indicator/channel_indicator_pixeltest.cc
index 8f8205a..70fda2c 100644
--- a/ash/system/channel_indicator/channel_indicator_pixeltest.cc
+++ b/ash/system/channel_indicator/channel_indicator_pixeltest.cc
@@ -88,7 +88,7 @@
GenerateScreenshotName(l10n_util::GetStringUTF8(
channel_indicator_utils::GetChannelNameStringResourceID(GetChannel(),
false))),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 2 : 0,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 3 : 0,
GetPrimaryShelf()->GetStatusAreaWidget()));
}
diff --git a/ash/system/notification_center/views/ash_notification_view_pixeltest.cc b/ash/system/notification_center/views/ash_notification_view_pixeltest.cc
index 57f8b517..f37e6f7 100644
--- a/ash/system/notification_center/views/ash_notification_view_pixeltest.cc
+++ b/ash/system/notification_center/views/ash_notification_view_pixeltest.cc
@@ -335,7 +335,7 @@
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("notification_popup_focus_ring"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 5 : 0,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 6 : 1,
notification_view));
}
diff --git a/ash/system/toast/system_toast_view_pixeltest.cc b/ash/system/toast/system_toast_view_pixeltest.cc
index a5df179..61f0bc70 100644
--- a/ash/system/toast/system_toast_view_pixeltest.cc
+++ b/ash/system/toast/system_toast_view_pixeltest.cc
@@ -82,8 +82,8 @@
GetContentsView()->AddChildView(std::make_unique<SystemToastView>(kTestText));
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
- "screenshot",
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 7 : 1,
+ GenerateScreenshotName("screenshot"),
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 8 : 1,
GetContentsView()));
}
diff --git a/ash/system/video_conference/bubble/bubble_view_pixeltest.cc b/ash/system/video_conference/bubble/bubble_view_pixeltest.cc
index 793ba036..50c9a8ffd 100644
--- a/ash/system/video_conference/bubble/bubble_view_pixeltest.cc
+++ b/ash/system/video_conference/bubble/bubble_view_pixeltest.cc
@@ -377,7 +377,7 @@
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("video_conference_tray_linux_bubble_one_app"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 10 : 0,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 11 : 1,
video_conference_tray()->GetBubbleView()));
controller()->AddMediaApp(CreateFakeMediaApp(
diff --git a/ash/system/video_conference/video_conference_tray_pixeltest.cc b/ash/system/video_conference/video_conference_tray_pixeltest.cc
index fd9cd20..a30a613e 100644
--- a/ash/system/video_conference/video_conference_tray_pixeltest.cc
+++ b/ash/system/video_conference/video_conference_tray_pixeltest.cc
@@ -101,7 +101,7 @@
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("video_conference_tray_no_focus_not_toggled"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 4 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 5 : 1,
video_conference_tray()));
Shell::Get()->focus_cycler()->FocusWidget(
@@ -115,14 +115,14 @@
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("video_conference_tray_audio_focused_not_toggled"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 4 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 5 : 1,
video_conference_tray()));
PressAndReleaseKey(ui::VKEY_RETURN);
EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
GenerateScreenshotName("video_conference_tray_audio_focused_and_toggled"),
- /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 6 : 1,
+ /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 7 : 1,
video_conference_tray()));
// Un-toggle the audio icon, then focus the video icon.
diff --git a/components/viz/service/display/renderer_pixeltest.cc b/components/viz/service/display/renderer_pixeltest.cc
index 606460b..e211358 100644
--- a/components/viz/service/display/renderer_pixeltest.cc
+++ b/components/viz/service/display/renderer_pixeltest.cc
@@ -923,7 +923,7 @@
const bool blur_fully_supported = !is_software_renderer();
auto comparator =
cc::FuzzyPixelComparator()
- .SetErrorPixelsPercentageLimit(blur_fully_supported ? 0.2f : 53.f)
+ .SetErrorPixelsPercentageLimit(blur_fully_supported ? 0.32f : 53.f)
.SetAvgAbsErrorLimit(blur_fully_supported ? 1 : 2)
.SetAbsErrorLimit(blur_fully_supported ? 1 : 8);
diff --git a/skia/config/SkUserConfig.h b/skia/config/SkUserConfig.h
index 5a76d82..67dfa01 100644
--- a/skia/config/SkUserConfig.h
+++ b/skia/config/SkUserConfig.h
@@ -143,6 +143,8 @@
#define SK_SUPPORT_LEGACY_RRECT_TRANSFORM
+#define SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING
+
///////////////////////// Imported from BUILD.gn and skia_common.gypi
/* In some places Skia can use static initializers for global initialization,
diff --git a/components/test/data/viz/bypass_texture_backdrop_extent.png b/components/test/data/viz/bypass_texture_backdrop_extent.png
index 07ac826..f2140f4 100644
--- a/components/test/data/viz/bypass_texture_backdrop_extent.png
+++ b/components/test/data/viz/bypass_texture_backdrop_extent.png
Binary files differ
diff --git a/content/test/content_test_bundle_data.filelist b/content/test/content_test_bundle_data.filelist
index 24ec47a7..9e3cc9c 100644
--- a/content/test/content_test_bundle_data.filelist
+++ b/content/test/content_test_bundle_data.filelist
@@ -7801,7 +7801,6 @@
data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_4320e727bc3e93838b16ee409b041d35.wasm.data
data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_5c8a35f8e9aeb15a737d16307ab8a3aa.zip
data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_d427110d3ae5eca7f33221205b23575c.metadata.jspb
-data/gpu/meet_effects/meet-gpu-tests/release/assets/rio_selfiesegmentation_darwinn_exec_d46eb6ae52e7b125129300761d693b5e.metadata.jspb
data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_full_sparse_v1008_0bda82336d236e21e52f2b74129b9883.dat
data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_gpu_hd_v1093_bd6bd17c2cf0b7f4f6753685523caa08.dat
data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_quantized_v3346_c5b35537731c3939ac5514f4edbea539.dat
@@ -7831,7 +7830,6 @@
data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_4ad1bc3b5d81b441d9ad4dff7ffb0e40.f16.abrolhos.metadata.jspb
data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_56a05a46169c1922089a8eb47b21e218.f16.wasm.data
data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_7a160e14443e5f65ef532adc94c1bbdc.f16.janeiro.metadata.jspb
-data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_7fb384efb53da537e32f6b4a7f807dd6.stablehlo.husky.metadata.jspb
data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_35037371ae2008ccd89389d157d7798c.xnxr.wasm.data
data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_d5c1210c15445cc5aed66de2c15261bd.xnxr.zip
data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_f55a5953c7cabbbc5bfcfbfe3035c5a1.xnxr.metadata.jspb
diff --git a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt
index d3c3993cd..586df21 100644
--- a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt
+++ b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt
@@ -469,6 +469,7 @@
crbug.com/40935289 [ angle-vulkan arm fuchsia web-engine-shell ] Pixel_Video_MP4_FourColors_Rot_90 [ Failure ]
crbug.com/40935289 [ angle-vulkan arm fuchsia web-engine-shell ] Pixel_Video_MP4_Rounded_Corner [ Failure ]
crbug.com/40935289 [ angle-vulkan arm fuchsia no-clang-coverage web-engine-shell ] Pixel_Video_VP9 [ Failure ]
+crbug.com/519220175 [ angle-swiftshader fuchsia web-engine-shell ] Pixel_ReflectedDiv [ Failure ]
# Flaky on Mac ASAN
crbug.com/372055518 [ angle-metal asan mac ] Pixel_WebGLReadPixelsTabSwitch_SoftwareCompositing [ Failure ]
diff --git a/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png
index f4d0c66..ba0b9bdc 100644
--- a/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png
+++ b/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png b/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png
index 6167415..41adb49 100644
--- a/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png
+++ b/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png
index 89eaec29..1784bcb 100644
--- a/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png
+++ b/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png
index ea141ef3..128b984 100644
--- a/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png
+++ b/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png
index 700ffc1..0e20ebd7 100644
--- a/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png
+++ b/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png
index e543bfd..45143ce0 100644
--- a/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png
+++ b/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png
index 673efbc..1a17562 100644
--- a/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png
+++ b/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png b/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png
index 4336d14b..b68a2b4 100644
--- a/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png
+++ b/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png b/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png
index bc91ff5c..b77e93a 100644
--- a/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png
+++ b/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png b/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png
index ca014f1..0f6376e 100644
--- a/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png
+++ b/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png
index ebfebac..7e15f654 100644
--- a/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png
+++ b/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png
index 8981ae8..7ac1fb5c 100644
--- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png
+++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png
index 3b8c279..0e051c73 100644
--- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png
+++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png
index dedd406..fdcf3b1 100644
--- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png
+++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png
index 9acefcdd..01baa72 100644
--- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png
+++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png
index d663899..b03a77e2 100644
--- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png
+++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png
index 4159aa0..e8748269 100644
--- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png
+++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png
index 41430bd..ae70efc 100644
--- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png
... (file diff truncated)
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/components/test/data/viz/bypass_texture_backdrop_extent.png b/components/test/data/viz/bypass_texture_backdrop_extent.png index 07ac826..f2140f4 100644 --- a/components/test/data/viz/bypass_texture_backdrop_extent.png +++ b/components/test/data/viz/bypass_texture_backdrop_extent.png Binary files differ diff --git a/content/test/content_test_bundle_data.filelist b/content/test/content_test_bundle_data.filelist index 24ec47a7..9e3cc9c 100644 --- a/content/test/content_test_bundle_data.filelist +++ b/content/test/content_test_bundle_data.filelist @@ -7801,7 +7801,6 @@ data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_4320e727bc3e93838b16ee409b041d35.wasm.data data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_5c8a35f8e9aeb15a737d16307ab8a3aa.zip data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_d427110d3ae5eca7f33221205b23575c.metadata.jspb -data/gpu/meet_effects/meet-gpu-tests/release/assets/rio_selfiesegmentation_darwinn_exec_d46eb6ae52e7b125129300761d693b5e.metadata.jspb data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_full_sparse_v1008_0bda82336d236e21e52f2b74129b9883.dat data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_gpu_hd_v1093_bd6bd17c2cf0b7f4f6753685523caa08.dat data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_quantized_v3346_c5b35537731c3939ac5514f4edbea539.dat @@ -7831,7 +7830,6 @@ data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_4ad1bc3b5d81b441d9ad4dff7ffb0e40.f16.abrolhos.metadata.jspb data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_56a05a46169c1922089a8eb47b21e218.f16.wasm.data data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_7a160e14443e5f65ef532adc94c1bbdc.f16.janeiro.metadata.jspb -data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_7fb384efb53da537e32f6b4a7f807dd6.stablehlo.husky.metadata.jspb data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_35037371ae2008ccd89389d157d7798c.xnxr.wasm.data data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_d5c1210c15445cc5aed66de2c15261bd.xnxr.zip data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_f55a5953c7cabbbc5bfcfbfe3035c5a1.xnxr.metadata.jspb diff --git a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt index d3c3993cd..586df21 100644 --- a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt +++ b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt @@ -469,6 +469,7 @@ crbug.com/40935289 [ angle-vulkan arm fuchsia web-engine-shell ] Pixel_Video_MP4_FourColors_Rot_90 [ Failure ] crbug.com/40935289 [ angle-vulkan arm fuchsia web-engine-shell ] Pixel_Video_MP4_Rounded_Corner [ Failure ] crbug.com/40935289 [ angle-vulkan arm fuchsia no-clang-coverage web-engine-shell ] Pixel_Video_VP9 [ Failure ] +crbug.com/519220175 [ angle-swiftshader fuchsia web-engine-shell ] Pixel_ReflectedDiv [ Failure ] # Flaky on Mac ASAN crbug.com/372055518 [ angle-metal asan mac ] Pixel_WebGLReadPixelsTabSwitch_SoftwareCompositing [ Failure ] diff --git a/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png index f4d0c66..ba0b9bdc 100644 --- a/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png +++ b/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png Binary files differ diff --git a/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png b/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png index 6167415..41adb49 100644 --- a/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png +++ b/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png index 89eaec29..1784bcb 100644 --- a/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png index ea141ef3..128b984 100644 --- a/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png index 700ffc1..0e20ebd7 100644 --- a/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png index e543bfd..45143ce0 100644 --- a/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png index 673efbc..1a17562 100644 --- a/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png b/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png index 4336d14b..b68a2b4 100644 --- a/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png +++ b/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png b/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png index bc91ff5c..b77e93a 100644 --- a/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png +++ b/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png b/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png index ca014f1..0f6376e 100644 --- a/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png +++ b/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png index ebfebac..7e15f654 100644 --- a/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png +++ b/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png index 8981ae8..7ac1fb5c 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png index 3b8c279..0e051c73 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png index dedd406..fdcf3b1 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png index 9acefcdd..01baa72 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png index d663899..b03a77e2 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png index 4159aa0..e8748269 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png index 41430bd..ae70efc 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png index 308cd3f..4ba1c6e 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png index a9f91360..d598999 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png index 2c4e002..3b32863 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png index 5e98f14a..3004ffab 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png index c0e12c0..64859a8 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png index 0910c1a6..2537df5 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png index 47e48dd..7bf2752 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png index 61e6976..568a74f 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png Binary files differ diff --git a/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png b/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png index 6cdf197..442da01 100644 --- a/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png +++ b/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png b/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png index 742df59..9269847 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png index 09ec1d52..43724e4f 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png index 0e36384..fd9f106 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png b/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png index 519406b..6822f6c 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png b/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png index 4c4f0708..4b049550d 100644 --- a/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png +++ b/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png b/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png index 60ab00e..7a425c9d 100644 --- a/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png +++ b/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-canvas-expected.png b/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-canvas-expected.png deleted file mode 100644 index 7d4e96d..0000000 --- a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-canvas-expected.png +++ /dev/null Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-image-expected.png b/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-image-expected.png deleted file mode 100644 index 7d4e96d..0000000 --- a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-image-expected.png +++ /dev/null Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/gpu-rasterization/images/color-profile-reflection-expected.png b/third_party/blink/web_tests/platform/linux/virtual/gpu-rasterization/images/color-profile-reflection-expected.png new file mode 100644 index 0000000..33bd491 --- /dev/null +++ b/third_party/blink/web_tests/platform/linux/virtual/gpu-rasterization/images/color-profile-reflection-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png b/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png index e640752..1d6e5dd 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png index 758f8f7..c83bad09 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png index 2ae064d6..3cd3b08 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png index 6b57fb40..2b4da4c 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png index 0af6b89..8173aa7 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png index a0c0a3c..72b21670 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png index 34e65603..bcb9464f 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png index 14a55e6..c238c7fc 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac-mac15-arm64/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/platform/mac-mac15-arm64/compositing/masks/mask-with-removed-filters-expected.png new file mode 100644 index 0000000..2df70a3 --- /dev/null +++ b/third_party/blink/web_tests/platform/mac-mac15-arm64/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.png b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.png new file mode 100644 index 0000000..d66505a --- /dev/null +++ b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.png b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.png new file mode 100644 index 0000000..3328ef8 --- /dev/null +++ b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png b/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png index 742df59..9269847 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png index 637c612..43cde00 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png index 2df70a3..e5b9d8c 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png b/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png index 2e451a2..29c8c35b 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/transform-3d-scales-different-x-y-expected.png b/third_party/blink/web_tests/platform/mac/compositing/transform-3d-scales-different-x-y-expected.png index 876591172..93e87e7 100644 ... (truncated)
Loading diff…
Original Bug Report
reported by [email protected]
Potential cross-origin GPU memory leak in Skia Ganesh via uninitialized approx-fit padding
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: The Skia Ganesh backend in the GPU process potentially leaks cross-origin pixel data due to improper texture coordinate clamping when using linear filters on approx-fit textures. Malicious sites may be able to read stale GPU memory from other origins by sampling uninitialized padding texels in recycled scratch textures.
Affected files:
third_party/skia/src/gpu/ganesh/effects/GrTextureEffect.hthird_party/skia/src/gpu/ganesh/effects/GrTextureEffect.cppthird_party/skia/src/gpu/ganesh/ops/TextureOp.cppthird_party/skia/src/gpu/ganesh/ops/QuadPerEdgeAA.cppthird_party/skia/src/gpu/ganesh/SurfaceContext.cppthird_party/skia/src/gpu/ganesh/GrResourceProvider.cppthird_party/skia/src/gpu/ganesh/GrBlurUtils.cppthird_party/skia/src/gpu/ganesh/Device_drawTexture.cpp
Estimated timestamp from git blame: 2020-01-24
Summary
In Chromium’s Skia Ganesh backend, the GrResourceCache is shared across all origins within the GPU process to facilitate Out-of-Process Rasterization (OOP-R). When complex filters (e.g., large blurs) are applied, Skia often allocates ‘approx-fit’ intermediate textures that are physically larger than their logical content. When these textures are recycled, their ‘padding’ region is not cleared. Due to a configuration choice in Chromium’s Skia build, the shader-based clamping logic for these textures may allow hardware bilinear samplers to fetch data from this uninitialized padding, leading to a potential cross-origin information leak.
Technical Details
In third_party/skia/src/gpu/ganesh/effects/GrTextureEffect.h, the constant kLinearInset defines the clamping boundary for texture subsets. It is calculated as 0.5f + kInsetEpsilon. In Chromium, the macro SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING is not defined, resulting in kInsetEpsilon being 0.f.
// third_party/skia/src/gpu/ganesh/effects/GrTextureEffect.h
#if defined(SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING)
inline static constexpr float kInsetEpsilon = 0.0001f;
#else
inline static constexpr float kInsetEpsilon = 0.f;
#endif
inline static constexpr float kLinearInset = 0.5f + kInsetEpsilon; // 0.5f in Chromium
When sampling a subset of width W, the shader clamps the coordinate to exactly W - 0.5. On many GPUs (especially mobile hardware using mediump), precision limits in the shader or the hardware bilinear unit can cause the sampler to fetch the texel at index W, which resides in the uninitialized padding.
Since GrResourceCache is shared across all GpuChannels (and thus all origins) in SharedContextState, a scratch texture previously used by a victim origin may be recycled for an attacker. If the attacker’s logical dimensions are smaller than the victim’s, the attacker can potentially sample the victim’s stale data in the padding. If the stale memory contains NaN or Inf bit patterns (common in F16/F32 textures), these values will propagate to the attacker’s output regardless of the sampling weight.
Potential Impact
This is a cross-origin information leak of GPU pixel data. An attacker could potentially reconstruct content rendered by other websites. On Android, the risk is elevated as the GPU process is currently unsandboxed by default.
Suggested Reproductions Steps (Hypothetical)
- From an attacker page, utilize a 2D canvas with a large CSS or Canvas filter (e.g.,
ctx.filter = 'blur(50px)') to force the allocation ofSkBackingFit::kApproxintermediate textures. - Prime the shared GPU scratch cache by having a different origin (victim) render content that uses similar approximate texture sizes.
- In the attacker’s context, draw the filtered content and sample the edges of the logical subset using linear filtering.
- Use a high-precision F16 canvas and additive blending (
globalCompositeOperation = 'lighter') to amplify subtle contributions from the padding texels. - Read back the edge pixels using
ctx.getImageData()to attempt reconstruction of the stale padding data.
Suggested Fix
Define SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING in Chromium’s Skia configuration (e.g., in skia/config/SkUserConfig.h or via GN defines). This adds a small epsilon (0.0001f) to the inset, ensuring that hardware samplers remain strictly within the logical texel boundaries even in the presence of precision errors.
Evaluated with Chrome root at commit: b3153093eb3c78c3e88ccf562bcbc20437a04b0e
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.
References
On This Page