Bug 219478

Summary:	GPU Process: Crash under ~RemoteLayerBackingStore call to flushDrawingContext()
Product:	WebKit	Reporter:	Tim Horton <thorton>
Component:	Layout and Rendering	Assignee:	Nobody <webkit-unassigned>
Status:	NEW
Severity:	Normal	CC:	bfulgham, sabouhallawa, simon.fraser, webkit-bug-importer, wenson_hsieh, zalan
Priority:	P2	Keywords:	InRadar
Version:	Other
Hardware:	Unspecified
OS:	Unspecified

Tim Horton

Reported 2020-12-02 19:50:25 PST

void WebCore::DisplayList::ItemBuffer::append<WebCore::DisplayList::FlushContext, WTF::ObjectIdentifier<WebCore::DisplayList::FlushIdentifierType>&>(WTF::ObjectIdentifier<WebCore::DisplayList::FlushIdentifierType>&) + 64 void WebCore::DisplayList::ItemBuffer::append<WebCore::DisplayList::FlushContext, WTF::ObjectIdentifier<WebCore::DisplayList::FlushIdentifierType>&>(WTF::ObjectIdentifier<WebCore::DisplayList::FlushIdentifierType>&) + 52 WebKit::RemoteImageBufferProxy<WebKit::ImageBufferShareableIOSurfaceBackend>::flushDrawingContextAndCommit() + 100 WebKit::RemoteImageBufferProxy<WebKit::ImageBufferShareableIOSurfaceBackend>::flushDrawingContext() + 76 WebKit::RemoteImageBufferProxy<WebKit::ImageBufferShareableIOSurfaceBackend>::~RemoteImageBufferProxy() + 108 WebKit::RemoteImageBufferProxy<WebKit::ImageBufferShareableIOSurfaceBackend>::~RemoteImageBufferProxy() + 16 WebKit::RemoteLayerBackingStore::~RemoteLayerBackingStore() + 40 std::__1::unique_ptr<WebKit::RemoteLayerBackingStore, std::__1::default_delete<WebKit::RemoteLayerBackingStore> >::reset(WebKit::RemoteLayerBackingStore*) + 32 WebCore::GraphicsLayerCA::updateCoverage(WebCore::GraphicsLayerCA::CommitState const&) + 168 WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers(WebCore::GraphicsLayerCA::CommitState&, float, WebCore::FloatPoint const&, bool&) + 1376 WebCore::GraphicsLayerCA::recursiveCommitChanges(WebCore::GraphicsLayerCA::CommitState&, WebCore::TransformState const&, float, WebCore::FloatPoint const&, bool) + 528 WebCore::GraphicsLayerCA::recursiveCommitChanges(WebCore::GraphicsLayerCA::CommitState&, WebCore::TransformState const&, float, WebCore::FloatPoint const&, bool) + 676 WebCore::GraphicsLayerCA::recursiveCommitChanges(WebCore::GraphicsLayerCA::CommitState&, WebCore::TransformState const&, float, WebCore::FloatPoint const&, bool) + 676

Attachments
Add attachment proposed patch, testcase, etc.

Tim Horton

Comment 1 2020-12-02 19:51:23 PST

I hit this on nyt.com

Tim Horton

Comment 2 2020-12-02 19:54:42 PST

Crash is Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Subtype: KERN_INVALID_ADDRESS at 0x000000011e5489e0

Radar WebKit Bug Importer

Comment 3 2020-12-09 19:51:13 PST

<rdar://problem/72164373>

Note You need to log in before you can comment on or make changes to this bug.