Rusty PNG �in Chromium and Skia

Status update + Next planned steps

(as of early December 2024)

(this is a public doc - anyone with a link can view, committers@chromium.org can comment)

Why do this status update now?

• The project seems ready to start Canary/Dev field trials soon
• The status update will give us a chance to:
• Learn what works
• Learn what doesn’t work
• and discuss what subset should / shouldn’t block�1) Canary/Dev trials,�2) Beta/Stable trials, and�3) shipping + transitioning ownership
• Discuss the next steps

Note: some slides may have additional info in the speaker notes to help with reading this slidedeck offline

What works

• Decoding
• CI/CQ: All tests pass: //ui/gfx/codec/png_codec_unittest.cc
• CI/CQ: All tests pass: //third_party/blink/…/png_image_decoder_test.cc
• Some tests use `skia::IsRustyPngEnabled()` to adjust their expectations
• For more details see the doc here
• Manual: https://philip.html5.org/tests/apng/tests.html passes for all valid images
• Fall back for some invalid images works in a different way from test expectations
• Manual: legacy Skia tests have been run against the new impl + remaining failures understood
• Manual: no functional diffs for ~1.5k+ PNG images from top-500 websites
• Encoding
• WIP / “works on my machine” (see https://crrev.com/c/6044082 and some Skia-side CLs)�All tests pass: //ui/gfx/codec/png_codec_unittest.cc
• WIP / in-progress / easy?: need to use `SkPngRustEncoder` from Blink and a few other places�No Rust+non-Rust coverage in CI/CQ (relying on `fieldtrial_testing_config.json`)

What doesn’t work (or works differently)

• Decoding (see the bugs query here)
• 370063145: Skia-vs-Blink do a slightly different alpha premultiplication (Chromium impact: off-by-one)
• 371592786: No overall failure if one frame fails to decode (desirable Chromium impact: parity with GIF)
• 362306048: Invalid-cHRM handling (impact: ???; [2025 edit: this bug has been fixed now])
• 362830091: No support for the `fSubset` option (no Chromium impact)
• 378697848: No support for sub-sampling (impact: Android OS [i.e. no Chromium/Clank/etc impact])
• 378936780: Avoid reading/consuming the input stream beyond `IEND` chunk (impact: Android OS)
• 359279096: No support for `sBIT` chunk (impact: round-tripping of `k565_Color`)
• 376550658: No support for `cLLi` and `mDCv` chunks (Chromium impact acked by @ccameron)
• 379305021: No “splatting” of interlaced images (Chromium impact: darker initial passes)
• 381292460: No API to retrieve unrecognized chunks (no Chromium impact)
• Encoding (see the bugs query here)
• 381139792: best/avg/slow vs compressionLevel=0-9 / filters=exact-set (Chromium impact: seems ok)
• 381139785: no support to encode ICC profile (no Chromium impact; [2025 edit: this bug is fixed now])

Performance

Current Rust/C++ runtime ratio (based on 1.5k+ images from top 500 websites):�1.0285

Remaining work based on the bugs query here:

• Low priority for this project:
• 371060427: Seeking to arbitrary earlier frames can be made faster
• 357876243: I used to think that an extra copy of pixels can be avoided
• Fixed:
• 356882657: Indexed=>RGBA transformation within SkiaRemaining:
• TODO:
• 357670287: Need to investigate impact of `-Coverflow-checks=on`
• Upper bound on potential improvement: ~3.24% (disabling the checks *everywhere*)

Other remaining work

• 356875275: Coverage through Skia CI/CQ
• Done: `SkPngRustDecoderTest.cpp` builds and runs locally
• Soon: `SkPngRustEncoderTest.cpp`
• Soon (?): CI/CQ coverage (tracked in 381306536)
• Missing: coverage through legacy tests
• Done: decoding tests run manually “on my machine” and all failures understood
• Difficulty #1: Need separate build where `libpng` is disabled
• Difficulty #2: Need to account for known differences
• Difficulty #3: Didn’t start looking at encoding tests
• 360375090: Research or add success-rate UMA metrics for PNG decoding
• Probably also need to figure out other UMA stuff�(I am familiar with //ui/gfx/codec UMA, but not with Blink UMA)
• Anything else to track and/or discuss?

Next steps: start Canary/Dev field trials in December

• Notes
• go/chrome-release-freezes: Open window from Dec 3rd to Dec 18th (then frozen until Jan 6th)
• go/chrome-schedule: M132 branched on Nov 11th. M133 Beta promotion planned for Jan 15th
• Remaining blockers
• Done: chrome://flags and Android WebView equivalent: https://crrev.com/c/5917005
• Done: relevant launch approvals
• TODO: land `enable_rust_png = true` CL (passes CQ, needs binary size increase LGTM)
• TODO: land `fieldtrial_testing_config.json` CL (passes CQ)
• TODO: investigate performance impact of `-Coverflow-checks=on`
• QUESTION: anything else to take care of?
• Stake-in-the-ground: Other issues from previous slides do not block this

Medium-term plan

• Blockers for Beta/Stable field trials
• Land encoding CLs
• Get reasonable stability and performance data from Canary/Dev trials
• Blockers for declaring the project as completed (but not for Beta/Stable trials)
• Remove `libpng` from Chromium and Pdfium
• Figure out test coverage via Skia tests
• Non-blockers
• Functional differences identified on previous slides

Long-term plans and other things

• Android
• Gain maps (e.g. C++ vs wait for Rust; see also b/329469053 and png issue #532)
• Speculating: Adoption of Rusty PNG
• `libpng` removal
• Chrome Security committed to removing `libpng` from Chromium, but not from Skia
• Chrome Security and Skia agree that maintaining 2 PNG codec implementations is undesirable
• Speculating: `libpng` in Skia will eventually be community-maintained or unsupported?
• Question: is it worthwhile to try engaging early with Flutter and other Skia clients?
• Long-term ownership
• Let me know if I can help with knowledge transfer in any way
• Other things
• Do I need explicit/more LGTMs on dev design doc + performance plans