| Summary: | ASSERTION FAILED: m_wrapper on webgl/max-active-contexts-webglcontextlost-prevent-default.html | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Alexey Proskuryakov <ap> | ||||||
| Component: | WebCore JavaScript | Assignee: | Chris Dumez <cdumez> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | cdumez, darin, dino, esprehn+autocc, ews-watchlist, ggaren, graouts, gyuyoung.kim, kondapallykalyan, rniwa, sabouhallawa, webkit-bot-watchers-bugzilla, webkit-bug-importer | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | Other | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=209660 | ||||||||
| Attachments: |
|
||||||||
|
Description
Alexey Proskuryakov
2020-04-01 10:48:56 PDT
Which revision? Since r259130, WebGLRenderingContextBase::scheduleTaskToDispatchContextLostEvent() keeps the wrapper alive while the event is pending. Give that we're crashing still, I believe this indicates the JS wrapper can get destroyed before scheduleTaskToDispatchContextLostEvent() even gets called. The provided command reproduced the issue for me, thanks. Created attachment 395192 [details]
Patch
Comment on attachment 395192 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395192&action=review > Source/WebCore/html/HTMLCanvasElement.cpp:963 > + if (is<WebGLRenderingContextBase>(m_context.get())) { > + // WebGL rendering context may fire contextlost / contextchange / contextrestored events at any point. > + return m_hasRelevantWebGLEventListener && !downcast<WebGLRenderingContextBase>(*m_context).isContextUnrecoverablyLost(); > + } Why not include is<WebGLRenderingContextBase>(m_context.get()) in the cached m_hasRelevantWebGLEventListener boolean to have one less check to do here? > Source/WebCore/html/HTMLCanvasElement.cpp:980 > +#if ENABLE(WEBGL) > + m_hasRelevantWebGLEventListener = hasEventListeners(eventNames().webglcontextchangedEvent) > + || hasEventListeners(eventNames().webglcontextlostEvent) > + || hasEventListeners(eventNames().webglcontextrestoredEvent); > +#endif We’re caching this because this is too expensive to do inside virtualHasPendingActivity? Comment on attachment 395192 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395192&action=review >> Source/WebCore/html/HTMLCanvasElement.cpp:963 >> + } > > Why not include is<WebGLRenderingContextBase>(m_context.get()) in the cached m_hasRelevantWebGLEventListener boolean to have one less check to do here? I like having the is<WebGLRenderingContextBase>() check in this function since I am doing a downcast<WebGLRenderingContextBase>() right after. I think doing it as you suggest would probably look less safe. >> Source/WebCore/html/HTMLCanvasElement.cpp:980 >> +#endif > > We’re caching this because this is too expensive to do inside virtualHasPendingActivity? 2 reasons: - Performance - virtualHasPendingActivity() gets called on a GC thread. Seems to be causing some crashes on the bots for some reason. I am investigating. Created attachment 395202 [details]
Patch
Committed r259364: <https://trac.webkit.org/changeset/259364> All reviewed patches have been landed. Closing bug and clearing flags on attachment 395202 [details]. |