From db1f0bd5919bf28595ad3b5bde5f2bbf081af2f5 Mon Sep 17 00:00:00 2001 From: Keeley Hammond Date: Mon, 23 Mar 2026 15:26:41 -0700 Subject: [PATCH 1/2] chore: cherry-pick 50b057660b4d from chromium --- patches/chromium/.patches | 1 + .../chromium/cherry-pick-50b057660b4d.patch | 150 ++++++++++++++++++ 2 files changed, 151 insertions(+) create mode 100644 patches/chromium/cherry-pick-50b057660b4d.patch diff --git a/patches/chromium/.patches b/patches/chromium/.patches index 454bd86f1f672..9eae40d7d080f 100644 --- a/patches/chromium/.patches +++ b/patches/chromium/.patches @@ -151,3 +151,4 @@ fix_update_dbus_signal_signature_for_xdg_globalshortcuts_portal.patch patch_osr_control_screen_info.patch cherry-pick-12f932985275.patch fix_mac_high_res_icons.patch +cherry-pick-50b057660b4d.patch diff --git a/patches/chromium/cherry-pick-50b057660b4d.patch b/patches/chromium/cherry-pick-50b057660b4d.patch new file mode 100644 index 0000000000000..0d6c14b83e32e --- /dev/null +++ b/patches/chromium/cherry-pick-50b057660b4d.patch @@ -0,0 +1,150 @@ +From 50b057660b4d37e050269c23c017e303e6104506 Mon Sep 17 00:00:00 2001 +From: Kai Ninomiya +Date: Wed, 11 Mar 2026 14:52:44 -0700 +Subject: [PATCH] [M146] Increment WebGL context generation number on context restore + +Objects created while the context is lost should not be valid to use +after the context is restored. +- Replace number_of_context_losses_ with a "context generation number" + which increments on both context loss and context restore. + - Technically, it would make sense to increment it only on context + restore, but just in case any logic is relying on the current + behavior, increment it in both places. + - It's uint64_t just in case someone figures out how to increment it 4 + billion times. +- Remove unused WebGLRenderingContextBase::number_of_context_losses_, + left over from before it was moved into WebGLContextObjectSupport. + +(cherry picked from commit c1433740f3ea902fd6b15d63c4865ad60a3761f9) + +Bug: 485935305 +Change-Id: I1007217c8e69cfb8de4f117e0b7845ca574579c4 +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7630664 +Reviewed-by: Kenneth Russell +Commit-Queue: Kai Ninomiya +Cr-Original-Commit-Position: refs/heads/main@{#1593726} +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7658823 +Auto-Submit: Kai Ninomiya +Bot-Commit: Rubber Stamper +Commit-Queue: Rubber Stamper +Cr-Commit-Position: refs/branch-heads/7680@{#2370} +Cr-Branched-From: 76b7d80e5cda23fe6537eed26d68c92e995c7f39-refs/heads/main@{#1582197} +--- + +diff --git a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc +index 05553e1..141c6b8 100644 +--- a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc ++++ b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc +@@ -24,7 +24,10 @@ + + void WebGLContextObjectSupport::OnContextLost() { + DCHECK(!is_lost_); +- number_of_context_losses_++; ++ // Invalidate all past objects. ++ // (It may not be strictly necessary to do this here, since it's also done in ++ // OnContextRestored, but we did it historically, and there's no harm in it.) ++ context_generation_++; + is_lost_ = true; + gles2_interface_ = nullptr; + extensions_enabled_.reset(); +@@ -33,6 +36,8 @@ + void WebGLContextObjectSupport::OnContextRestored( + gpu::gles2::GLES2Interface* gl) { + DCHECK(is_lost_); ++ // Invalidate all past objects. ++ context_generation_++; + is_lost_ = false; + gles2_interface_ = gl; + } +diff --git a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h +index f61cf9c2..79cfde2 100644 +--- a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h ++++ b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h +@@ -36,10 +36,10 @@ + bool IsWebGL2() const { return is_webgl2_; } + bool IsLost() const { return is_lost_; } + +- // How many context losses there were, to check whether a WebGLObject was +- // created since the last context resoration or before that (and hence invalid +- // to use). +- uint32_t NumberOfContextLosses() const { return number_of_context_losses_; } ++ // Which "generation" the context is on (essentially, how many times it has ++ // been restored), to check whether a WebGLObject was created since the last ++ // context restoration, or before that (and hence invalid to use). ++ uint64_t GetContextGeneration() const { return context_generation_; } + + bool ExtensionEnabled(WebGLExtensionName name) const { + return extensions_enabled_.test(name); +@@ -68,7 +68,7 @@ + std::bitset extensions_enabled_ = {}; + raw_ptr gles2_interface_ = nullptr; + +- uint32_t number_of_context_losses_ = 0; ++ uint64_t context_generation_ = 0; + bool is_lost_ = true; + bool is_webgl2_; + }; +diff --git a/third_party/blink/renderer/modules/webgl/webgl_object.cc b/third_party/blink/renderer/modules/webgl/webgl_object.cc +index 9d984de..07e0a9a 100644 +--- a/third_party/blink/renderer/modules/webgl/webgl_object.cc ++++ b/third_party/blink/renderer/modules/webgl/webgl_object.cc +@@ -33,9 +33,9 @@ + + WebGLObject::WebGLObject(WebGLContextObjectSupport* context) + : context_(context), +- cached_number_of_context_losses_(std::numeric_limits::max()) { ++ context_generation_at_creation_(std::numeric_limits::max()) { + if (context_) { +- cached_number_of_context_losses_ = context->NumberOfContextLosses(); ++ context_generation_at_creation_ = context->GetContextGeneration(); + } + } + +@@ -46,7 +46,7 @@ + // the objects they ever created, so there's no way to invalidate them + // eagerly during context loss. The invalidation is discovered lazily. + return (context == context_ && context_ != nullptr && +- cached_number_of_context_losses_ == context->NumberOfContextLosses()); ++ context_generation_at_creation_ == context->GetContextGeneration()); + } + + void WebGLObject::SetObject(GLuint object) { +@@ -71,7 +71,7 @@ + return; + } + +- if (context_->NumberOfContextLosses() != cached_number_of_context_losses_) { ++ if (context_->GetContextGeneration() != context_generation_at_creation_) { + // This object has been invalidated. + return; + } +diff --git a/third_party/blink/renderer/modules/webgl/webgl_object.h b/third_party/blink/renderer/modules/webgl/webgl_object.h +index bb56df0..97caa90 100644 +--- a/third_party/blink/renderer/modules/webgl/webgl_object.h ++++ b/third_party/blink/renderer/modules/webgl/webgl_object.h +@@ -123,9 +123,9 @@ + + GLuint object_ = 0; + +- // This was the number of context losses of the object's associated +- // WebGLContext at the time this object was created. +- uint32_t cached_number_of_context_losses_; ++ // The context generation number of the associated WebGLContext when the ++ // object was created, to prevent reuse in later generations. ++ uint64_t context_generation_at_creation_; + + unsigned attachment_count_ = 0; + +diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h +index 30d910ed..89229956 100644 +--- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h ++++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h +@@ -2121,8 +2121,6 @@ + + bool has_been_drawn_to_ = false; + +- uint32_t number_of_context_losses_ = 0; +- + // Tracks if the context has ever called glBeginPixelLocalStorageANGLE. If it + // has, we need to start using the pixel local storage interrupt mechanism + // when we take over the client's context. From ae5f2e039e4f1944544fd75ed2104930f4c74bf7 Mon Sep 17 00:00:00 2001 From: PatchUp <73610968+patchup[bot]@users.noreply.github.com> Date: Mon, 23 Mar 2026 22:42:48 +0000 Subject: [PATCH 2/2] chore: update patches --- .../chromium/cherry-pick-50b057660b4d.patch | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/patches/chromium/cherry-pick-50b057660b4d.patch b/patches/chromium/cherry-pick-50b057660b4d.patch index 0d6c14b83e32e..f8c2e7ef7e6e3 100644 --- a/patches/chromium/cherry-pick-50b057660b4d.patch +++ b/patches/chromium/cherry-pick-50b057660b4d.patch @@ -1,7 +1,7 @@ -From 50b057660b4d37e050269c23c017e303e6104506 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Kai Ninomiya Date: Wed, 11 Mar 2026 14:52:44 -0700 -Subject: [PATCH] [M146] Increment WebGL context generation number on context restore +Subject: [M146] Increment WebGL context generation number on context restore Objects created while the context is lost should not be valid to use after the context is restored. @@ -29,13 +29,12 @@ Bot-Commit: Rubber Stamper Commit-Queue: Rubber Stamper Cr-Commit-Position: refs/branch-heads/7680@{#2370} Cr-Branched-From: 76b7d80e5cda23fe6537eed26d68c92e995c7f39-refs/heads/main@{#1582197} ---- diff --git a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc -index 05553e1..141c6b8 100644 +index 6a3b1416354e7993e7a9ebd25c4ca08593105d9a..83941f8163a5e9425f2df8fd3bb98e1fd37537ad 100644 --- a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc +++ b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.cc -@@ -24,7 +24,10 @@ +@@ -22,7 +22,10 @@ WebGLContextObjectSupport::WebGLContextObjectSupport( void WebGLContextObjectSupport::OnContextLost() { DCHECK(!is_lost_); @@ -47,7 +46,7 @@ index 05553e1..141c6b8 100644 is_lost_ = true; gles2_interface_ = nullptr; extensions_enabled_.reset(); -@@ -33,6 +36,8 @@ +@@ -31,6 +34,8 @@ void WebGLContextObjectSupport::OnContextLost() { void WebGLContextObjectSupport::OnContextRestored( gpu::gles2::GLES2Interface* gl) { DCHECK(is_lost_); @@ -57,10 +56,10 @@ index 05553e1..141c6b8 100644 gles2_interface_ = gl; } diff --git a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h -index f61cf9c2..79cfde2 100644 +index 907866bb21acf9647d1c0ecd791e642e96b734fc..ba8b79f8bb9db12058614982a625baaff5546af7 100644 --- a/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h +++ b/third_party/blink/renderer/modules/webgl/webgl_context_object_support.h -@@ -36,10 +36,10 @@ +@@ -33,10 +33,10 @@ class MODULES_EXPORT WebGLContextObjectSupport : public ScriptWrappable { bool IsWebGL2() const { return is_webgl2_; } bool IsLost() const { return is_lost_; } @@ -75,7 +74,7 @@ index f61cf9c2..79cfde2 100644 bool ExtensionEnabled(WebGLExtensionName name) const { return extensions_enabled_.test(name); -@@ -68,7 +68,7 @@ +@@ -65,7 +65,7 @@ class MODULES_EXPORT WebGLContextObjectSupport : public ScriptWrappable { std::bitset extensions_enabled_ = {}; raw_ptr gles2_interface_ = nullptr; @@ -85,10 +84,10 @@ index f61cf9c2..79cfde2 100644 bool is_webgl2_; }; diff --git a/third_party/blink/renderer/modules/webgl/webgl_object.cc b/third_party/blink/renderer/modules/webgl/webgl_object.cc -index 9d984de..07e0a9a 100644 +index 9d984de0073796f23a5038bfc0a51ec676179765..07e0a9a4aa3406a1298a677a3159edadc5f2cbb5 100644 --- a/third_party/blink/renderer/modules/webgl/webgl_object.cc +++ b/third_party/blink/renderer/modules/webgl/webgl_object.cc -@@ -33,9 +33,9 @@ +@@ -33,9 +33,9 @@ namespace blink { WebGLObject::WebGLObject(WebGLContextObjectSupport* context) : context_(context), @@ -100,7 +99,7 @@ index 9d984de..07e0a9a 100644 } } -@@ -46,7 +46,7 @@ +@@ -46,7 +46,7 @@ bool WebGLObject::Validate(const WebGLContextObjectSupport* context) const { // the objects they ever created, so there's no way to invalidate them // eagerly during context loss. The invalidation is discovered lazily. return (context == context_ && context_ != nullptr && @@ -109,7 +108,7 @@ index 9d984de..07e0a9a 100644 } void WebGLObject::SetObject(GLuint object) { -@@ -71,7 +71,7 @@ +@@ -71,7 +71,7 @@ void WebGLObject::DeleteObject(gpu::gles2::GLES2Interface* gl) { return; } @@ -119,10 +118,10 @@ index 9d984de..07e0a9a 100644 return; } diff --git a/third_party/blink/renderer/modules/webgl/webgl_object.h b/third_party/blink/renderer/modules/webgl/webgl_object.h -index bb56df0..97caa90 100644 +index bb56df0f99e8e8432e03442feb9302b8dde27d01..97caa90e34288911b1a827e60c2569544d2b8f69 100644 --- a/third_party/blink/renderer/modules/webgl/webgl_object.h +++ b/third_party/blink/renderer/modules/webgl/webgl_object.h -@@ -123,9 +123,9 @@ +@@ -123,9 +123,9 @@ class WebGLObject : public ScriptWrappable { GLuint object_ = 0; @@ -136,10 +135,10 @@ index bb56df0..97caa90 100644 unsigned attachment_count_ = 0; diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h -index 30d910ed..89229956 100644 +index 060563a9955a8564d176177fc389c4f98aa64e9f..f24221cb2f47cfde515179ff945c13756487ebfc 100644 --- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h +++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h -@@ -2121,8 +2121,6 @@ +@@ -2073,8 +2073,6 @@ class MODULES_EXPORT WebGLRenderingContextBase bool has_been_drawn_to_ = false;