Cross-process ImageBitmap/ImageBuffer transfer under Site Isolation

Component: WebKit GPU Process | e594530

Under Site Isolation, GPU-backed ImageBuffers live in the GPU process and each Web process references them via a RemoteRenderingBackend proxy scoped to its own GPU connection. Previously moveToImageBuffer only moved buffers within one GPU-process connection, so SerializedScriptValue refused to carry an ImageBitmap into a message bound for a different renderer. This commit extends the transfer mechanism across process boundaries.

Significance

A new brokered protocol spanning the GPU, UI, Network, and two Web processes moves GPU-owned pixel memory between renderers, fixing silent failure of ImageBitmap transfer to cross-site iframes. A process-qualified ImageBufferTransferIdentifier parks the buffer in a GPU-process-wide "transfer heap" via SerializedImageBuffer::sinkIntoTransferHandle; the UI process acts as trust broker authorizing the destination before the receiver pulls it into its own RemoteRenderingBackend. MessagePort delivery bounces through the Network process first.

Audit directions

Narrow: confirm the UI-process authorization settles before any destination process can claim the transfer-heap entry — a claim that races the broker is the failure. Wider: any GPU-process-wide handoff heap keyed by a process-qualified identifier shares the double-claim/confused-destination risk; audit other sinkInto*Handle/transfer-identifier paths. The tell: a transfer heap entry readable before the broker's authorization callback has run.

---