← WebKit — 2026-W36

b3d7d6cdd798bcc0900041524247ee71706e6d05  webgpu.github.io/webgpu-samples/?sample=videoUploading does not play Lake with videoSource = videoElement

severity medium class TypeConfusion confidence 0.4 signal score 7.37 Source/WebCore/Modules
Primitive: WebGPU importExternalTexture passed a video playerIdentifier to the GPU process for a player not hosted there
Triage note: externalTextureForDescriptor now gates the accelerated media-identifier path on player->isHostedInGPUProcess() (MediaPlayerType::Remote) and moves undestroy()/map-remove into the mediaIdentifier branch. Prevents handing the GPU process a MediaPlayerIdentifier for a non-remote player (resource/identifier confusion), but no clear memory-corruption primitive demonstrated.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.2), surgical (+1.3)

Commit message

webgpu.github.io/webgpu-samples/?sample=videoUploading does not play Lake with videoSource = videoElement
https://bugs.webkit.org/show_bug.cgi?id=323225
rdar://186470526

Reviewed by Dan Glastonbury.

In order to import video using the accelerated CVMetalTextureCache path,
we must ensure the video is already in the GPU process.

Test: fast/webgpu/external-texture-from-webm-video-element.html

* Source/WebCore/Modules/WebGPU/GPUDevice.cpp:
(WebCore::GPUDevice::importExternalTexture):
* Source/WebCore/Modules/WebGPU/GPUExternalTextureDescriptor.h:
(WebCore::GPUExternalTextureDescriptor::mediaIdentifierForSource):
(WebCore::GPUExternalTextureDescriptor::mediaIdentifier const):
* Source/WebCore/platform/graphics/MediaPlayer.cpp:
(WebCore::MediaPlayer::isHostedInGPUProcess const):
* Source/WebCore/platform/graphics/MediaPlayer.h:

* LayoutTests/fast/webgpu/external-texture-from-webm-video-element-expected.txt: Added.
* LayoutTests/fast/webgpu/external-texture-from-webm-video-element.html: Added.

Canonical link: https://commits.webkit.org/320427@main

Before / after

Loading diff…