|
Donner SVG 0.8.0-pre
SVG editor and embeddable C++20 engine.
|
|
|
Donner SVG 0.8.0-pre
SVG editor and embeddable C++20 engine.
|
Status: Implementing. Production cutover remains open across shader selection, resource ownership, indexed UI rendering, native mapping and surfaces, and the browser bridge. The implementation plan below contains the work required to complete that cutover.\ Created: 2026-07-05\ Updated: 2026-09-11\ Author: Claude Fable 5.1\ Drafted by: GPT-5.6 Sol
Donner's GPU runtime is the interface between Geode/editor rendering and Metal, Vulkan, or browser WebGPU. The remaining work is to make production callers use that interface end to end, supply the missing draw, mapping, upload, and presentation operations, and remove the transitional WebGPU implementation from the dependency closure.
donner::gpu provides the foundation for resource validation, command recording, submission, backend execution, and typed shader generation. Production GeodeDevice, filter resource plumbing, texture caches, and editor presentation still depend on concrete WebGPU objects. Native shader execution tests therefore establish individual capabilities; they do not establish a complete native editor or a Rust-independent build.
The target is an original C++20 runtime serving Donner's own rendering requirements. It is not a WebGPU C ABI implementation or a general shader compiler.
Checked items identify integrated capabilities; unchecked items still require implementation or qualification. A backend-only test does not close a production migration item. Keep regression commits and their fixes together in a focused reviewable change.
flowchart TD
SVG[SVG rendering and filter graph] --> GEODE[RendererGeode and renderer services]
EDITOR[Editor presentation and ImGui draw data] --> UI[Runtime UI renderer and texture registry]
GEODE --> GPU[donner::gpu Device and command/resource contracts]
UI --> GPU
GPU --> METAL[Metal resources, completion and surfaces]
GPU --> VULKAN[Vulkan resources, completion and surfaces]
GPU --> WEB[Donner browser bridge to navigator.gpu]
IR[Typed Donner shader IR] --> BUILD[Build-time WGSL / MSL / SPIR-V generation]
BUILD --> ARTIFACTS[Backend shader artifacts and layouts]
ARTIFACTS --> GEODE
ARTIFACTS --> UI
TESTS[Recording and model tests] -.-> GPU
The runtime stays under donner/gpu/; RendererInterface remains the SVG-level renderer contract. Recording support is test-only. Production renderer and UI code consume the selected device rather than a concrete transition adapter. The initial GPU interface remains internal to Donner; exposing native device adoption to embedders is a separate API decision after lifetime and threading contracts qualify.
Resource handles are move-only values associated with a device and slot generation. Device owns validation and backend dispatch; operations return gpu::Result<T> or status values. Backend resources referenced by submitted work require retirement through completion serials.
The remaining migration must preserve three distinct texture roles:
| Role | Required ownership and validity |
|---|---|
| Detached renderer snapshot | Own backing through sampling/readback and producer teardown; keep content extent distinct from allocation extent. |
| Borrowed frame texture | Borrow without taking backing ownership; validity ends at the documented frame boundary. |
| Acquired surface texture | Belong to one surface acquisition; present, abandon, reconfigure, or surface destruction invalidates the acquisition. |
Host-provided native objects enter through a trusted embedding boundary with explicit ownership. An imported registration does not imply ownership of its backing. Device, generation, format, usage, and range checks remain necessary when replacing aliases with direct runtime handles. The test matrix below is the acceptance boundary for each migration; this table is not a claim that every remaining caller already enforces it.
A frame records render, compute, and copy work in the intended order through runtime encoders. The migration must not introduce per-pipeline queue submissions or lose ordering around layer copies. Completion of a recorded frame and completion of submitted GPU work are distinct events.
Thread affinity remains explicit. The async renderer retains worker-owned device operations; cross-thread presentation passes only documented frame/snapshot forms. UI registrations and mapping requests retain their resources until their consuming work or cancellation completes.
Native drawing and shader migration can proceed alongside resource migration and platform hooks. UI migration depends on indexed drawing and runtime textures/uploads. Device ownership switches only after shader selection, resources, mapping, UI, and platform presentation work together.
Typed shader programs are authored using Donner's IR and translated to deterministic backend artifacts at build time. Production binaries consume the artifact appropriate to the selected backend without linking shader emitters merely to regenerate constant shader text.
WGSL/MSL/SPIR-V remain build outputs, not committed or large inline emitted-shader goldens. Use focused structure/layout/error assertions, deterministic generation, real compiler validation, native execution, and strict renderer pixel comparisons. IR serialization tests retain their separate role.
Bazel is the primary build. CMake must describe the same native sources, shader artifacts, platform libraries, and feature flags. Tiny renderer profiles must remain independent of GPU backend linkage. The browser WebGPU implementation and native drivers are host services outside Donner's source and binary closure; the bridge and backend code calling them belong to Donner.
Implementation inputs are Donner requirements, algorithms, tests and black-box renderer outputs; the public WebGPU, WGSL, Vulkan, and SPIR-V specifications; and official Metal documentation/SDK interfaces.
Do not copy, translate, vendor, link, or retain implementation code or internal tests from wgpu, wgpu-native, Naga, Dawn, or Tint in the completed runtime, shader tooling, tests, or CI. Record the requirement/specification, algorithm choices, verification targets, and SDK/tool inputs for each implementation change. Keep transition reference pixels/counters as test data; remove the legacy implementation when it no longer has a migration caller.
The no-Rust requirement applies to build and artifact closure. No shipped artifact or non-test closure may fetch/invoke Rust tooling or depend on a Rust-built GPU library. Inert reference material is confined to the reviewed resvg/tiny-skia prefixes. The tiny-skia Rust cross-validation fixture is confined to the vendored workspace's own tests, without consumers or re-exports outside that test workspace. No Donner target, including tests, may reach the fixture or its Rust-built objects. A transitive module declaration alone is not evidence that a Rust toolchain executes.
tools/gpu_inventory/check_no_rust_dependencies.py and its tests enforce the tracked-tree rules; tools/cmake/gen_cmakelists.py --check also validates generated CMake output. Final closure acceptance additionally requires all verifier categories blocking, analyzed dependency/link evidence, and source-archive builds without rustc or cargo. Do not treat a lexical scan as complete proof of transitive build or artifact contents.
Untrusted SVG controls geometry, images, filter graphs, dimensions, and repetition. It does not provide native handles, arbitrary shader source, or serialized GPU commands. The remaining runtime operations must preserve release-build validation of sizes, arithmetic, usage, device identity, resource generation, and binding/copy ranges, plus bounded allocations and waits.
New mapping, indexed-draw, upload-origin, surface, and browser-ID paths require negative cases for invalid ranges, stale handles, cancellation, resource refusal, and loss. Use bounded structured command tests and backend fault injection; do not rely on driver errors or optional diagnostic assertions to enforce the contract. Capture output must not contain pointers, native handles, private paths, or process addresses. Backend failures must propagate without corrupting editor/DOM ownership.
The required owning tests and missing enforcement surfaces are listed below. Optional diagnostics and physical-hardware observations are evidence with their stated limits, not universal guarantees.
Extend existing targets where they own the changed behavior. Add focused native surface/browser bridge targets for new hooks; their existence and actual execution are outstanding work. The GPU operation and shader manifests must use the complete repository input set, with //tools/gpu_inventory:manifest_freshness_tests as the freshness gate.
| Contract / remaining work | Owning verification |
|---|---|
| Indexed draws, resource identity, command/lifetime validation | //donner/gpu:gpu_tests; extend native Metal/Vulkan execution tests and browser contract tests for indexed draws. |
| Shader structure and emitter contracts | //donner/gpu/shader:shader_tests; msl_xcrun_validation_tests, spirv_val_validation_tests, and wgsl_emitter_geode_validation_tests in the same package. |
| Native vertex layouts and pixels | //donner/gpu/metal/tests:metal_solid_fill_tests, //donner/gpu/vulkan/tests:vulkan_solid_fill_tests; add the matching browser execution cases. |
| Snapshot/target lifetime, alpha, cropping, refusal | //donner/svg/renderer/tests:renderer_geode_tests; replace adapter-only coverage with native runtime execution as each caller migrates. |
| Filter resource ordering, scratch and working sets | //donner/svg/renderer/geode:geode_filter_engine_tests, //donner/svg/renderer/tests:renderer_geode_tests, and native filter execution suites. |
| Upload reuse, UI texture lifetime and thumbnails | //donner/editor/tests:gl_texture_cache_tests, //donner/editor/tests:layer_thumbnail_golden_tests; extend them for runtime-backed resources. |
| Mapping, loss, cancellation and native surfaces | Shared gpu_tests plus new owning native-hook tests and actual editor surface execution; current default unsupported hooks do not qualify a backend. |
| Editor ordering and presentation | The explicit Geode editor lane below, plus the browser rendering/interaction lanes for the selected bridge. |
| Structural counters, memory, timing and size | //donner/gpu/baseline:baseline_counters_tests, //donner/svg/renderer/geode:geode_perf_tests, and the paired measurements required by the cutover gates. |
| Dependency closure | //tools/gpu_inventory:check_no_rust_dependencies_tests, the blocking verifier invocation, generated CMake validation, and analyzed/source-archive/artifact evidence. |
Run the full bazel test //... gate and, separately, these targets with --config=geode:
Use strict pixelmatch for image acceptance. Include existing resvg filter cases for the migrated families, chained filters, fractional alpha, nonzero subregions, clips/masks, and DPR2 workloads. Unsupported-device skips and compile-only jobs must remain distinguishable from actual execution. The physical adapter/browser matrix and size budgets are maintained in 0064: GPU release matrix.
The exact integrated candidate must satisfy all applicable platform gates:
1.15.0