Bug 250558 - texSubImage2D crashed on iOS16 + WebGL2 + large WASM memory
Summary: texSubImage2D crashed on iOS16 + WebGL2 + large WASM memory
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebGL (show other bugs)
Version: WebKit Local Build
Hardware: iPhone / iPad iOS 16
: P2 Normal
Assignee: Kimmo Kinnunen
URL:
Keywords: InRadar
: 250862 (view as bug list)
Depends on:
Blocks:
 
Reported: 2023-01-13 03:29 PST by fuyoucheng
Modified: 2023-05-22 01:23 PDT (History)
5 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description fuyoucheng 2023-01-13 03:29:05 PST
How to reproduce:
1. Create a new Untiy WebGL project with an empty scene, 
2. Set graphic api to WebGL2,
3. Set WASM initial memory to a large size (by adding "-s TOTAL_MEMORY=768MB" to PlayerSettings.WebGL.emscriptenArgs)
4. Build and load with Safari on iPhone12 with iOS16,
5. Safari report error when loading.

Rootcause:
Unity called texSubImage2D during initialization, Safari report error when invoking this api due to insufficient memory.
But that texture is 4*4 RGBA UNSIGNED_BYTE, should not cause any memory pressure.
When looking into WebGL2RenderingContext::texSubImage2D in WebKit source code, we found:
In WebGLRenderingContextBase::texImageArrayBufferViewHelper, variable 'data' created by WebGLRenderingContextBase::validateTexFuncData has incorrect value.
data.m_bufSize ought to be pixel data length, but acturally assigned as arrayBuffer(whole WASM memory) length - pixel data offset, which is much more larger.
Then later in IPC::Encoder::encodeFixedLengthData, encoder buffer will grow by this large size and lead to memory issue.
Comment 1 Radar WebKit Bug Importer 2023-01-16 12:38:23 PST
<rdar://problem/104305743>
Comment 2 Kimmo Kinnunen 2023-02-01 00:38:28 PST
*** Bug 250862 has been marked as a duplicate of this bug. ***
Comment 3 Kimmo Kinnunen 2023-02-01 00:38:48 PST
See bug 250558 for a test case
Comment 4 Kimmo Kinnunen 2023-02-01 06:51:29 PST
Pull request: https://github.com/WebKit/WebKit/pull/9451
Comment 5 EWS 2023-02-02 00:40:03 PST
Committed 259742@main (905fdd75fe5d): <https://commits.webkit.org/259742@main>

Reviewed commits have been landed. Closing PR #9451 and removing active labels.
Comment 6 Kimmo Kinnunen 2023-05-22 01:23:18 PDT
The fix shipped in iOS 16.4, macOS 12.3, Safari 16.4