236501 2022-02-11 06:42:55 -0800 GPUP WebGL: WTF::RefCountedBase::applyRefDerefThreadingCheck() fails due to RemoteGraphicsContextGL::paintPixelBufferToImageBuffer 2022-02-15 05:11:51 -0800 1 1 1 Unclassified WebKit WebGL Other Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=236382 InRadar P2 Normal --- 217211 1 kkinnunen kkinnunen dino jonlee kbr kkinnunen koivisto webkit-bug-importer oldest_to_newest 1840326 0 kkinnunen 2022-02-11 06:42:55 -0800 GPUP WebGL: WTF::RefCountedBase::applyRefDerefThreadingCheck() fails due to RemoteGraphicsContextGL::paintPixelBufferToImageBuffer Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 JavaScriptCore 0x132b265be WTFCrash + 14 1 WebCore 0x14e8544e3 WTF::RefCountedBase::applyRefDerefThreadingCheck() const + 179 (RefCounted.h:114) 2 WebCore 0x14e8542b9 WTF::RefCountedBase::derefBase() const + 25 (RefCounted.h:130) 3 WebCore 0x14e8df579 WTF::RefCounted<JSC::ArrayBufferView, std::__1::default_delete<JSC::ArrayBufferView> >::deref() const + 25 (RefCounted.h:189) 4 WebCore 0x152c9fc15 WebCore::GraphicsContextGL::paintToCanvas(WebCore::GraphicsContextGLAttributes const&, WebCore::PixelBuffer&&, WebCore::IntSize const&, WebCore::GraphicsContext&)::$_15::operator()(void*, void const*, unsigned long) const + 37 (GraphicsContextGLCG.cpp:531) 5 WebCore 0x152c9fbe5 WebCore::GraphicsContextGL::paintToCanvas(WebCore::GraphicsContextGLAttributes const&, WebCore::PixelBuffer&&, WebCore::IntSize const&, WebCore::GraphicsContext&)::$_15::__invoke(void*, void const*, unsigned long) + 37 (GraphicsContextGLCG.cpp:530) 6 CoreGraphics 0x7ff811b68285 data_release_info + 31 7 CoreGraphics 0x7ff811b19c3e data_provider_finalize + 64 8 CoreGraphics 0x7ff811adfa2a data_provider_retain_count + 74 9 CoreFoundation 0x7ff80c933d30 _CFRelease + 478 10 CoreGraphics 0x7ff811b454f4 image_finalize + 103 11 CoreFoundation 0x7ff80c933c46 _CFRelease + 244 12 WebCore 0x14ebfed19 WTF::RetainPtr<CGImage*>::~RetainPtr() + 57 (RetainPtr.h:178) 13 WebCore 0x14ebcb145 WTF::RetainPtr<CGImage*>::~RetainPtr() + 21 (RetainPtr.h:176) 14 WebCore 0x152baeeba WebCore::NativeImage::~NativeImage() + 186 (NativeImage.cpp:50) 15 WebCore 0x152baf095 WebCore::NativeImage::~NativeImage() + 21 (NativeImage.cpp:47) 16 WebCore 0x14ebf29ca WTF::ThreadSafeRefCounted<WebCore::NativeImage, (WTF::DestructionThread)1>::deref() const::'lambda'()::operator()() const + 42 (ThreadSafeRefCounted.h:117) 17 WebCore 0x14ebf2979 WTF::Detail::CallableWrapper<WTF::ThreadSafeRefCounted<WebCore::NativeImage, (WTF::DestructionThread)1>::deref() const::'lambda'(), void>::call() + 25 (Function.h:53) 18 JavaScriptCore 0x132b503b2 WTF::Function<void ()>::operator()() const + 130 19 JavaScriptCore 0x132bd719e WTF::RunLoop::performWork() + 318 20 JavaScriptCore 0x132bdaa6e WTF::RunLoop::performWork(void*) + 30 21 CoreFoundation 0x7ff80c866c1b __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 Thread 7:: RemoteRenderingBackend work queue 0 libsystem_kernel.dylib 0x7ff80c76399a mach_msg_trap + 10 1 libsystem_kernel.dylib 0x7ff80c763d08 mach_msg + 56 2 libsystem_kernel.dylib 0x7ff80c765f35 vm_copy + 106 3 CoreGraphics 0x7ff811cb92d0 create_protected_copy + 181 4 CoreGraphics 0x7ff811b07274 CGDataProviderCreateWithCopyOfData + 12 5 CoreGraphics 0x7ff811b07254 CGDataProviderCreateTrustedWithCopyOfData + 9 6 CoreGraphics 0x7ff811b070a2 CGBitmapContextCreateImage + 133 7 WebKit 0x1208c31dc WebKit::ShareableBitmap::makeCGImageCopy() + 108 (ShareableBitmapCG.cpp:171) 8 WebKit 0x11fd857f3 WebKit::ShareableBitmap::createPlatformImage() + 35 (ShareableBitmap.h:123) 9 WebKit 0x120facd67 WebKit::ImageBufferShareableBitmapBackend::copyNativeImage(WebCore::BackingStoreCopy) const + 55 (ImageBufferShareableBitmapBackend.cpp:148) 10 WebCore 0x152c90b91 WebCore::ImageBufferCGBackend::draw(WebCore::GraphicsContext&, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&) + 161 (ImageBufferCGBackend.cpp:141) 11 WebKit 0x11fd9a2f0 WebCore::ConcreteImageBuffer<WebKit::ImageBufferShareableBitmapBackend>::draw(WebCore::GraphicsContext&, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&) + 96 (ConcreteImageBuffer.h:167) 12 WebCore 0x152b5b6da WebCore::GraphicsContext::drawImageBuffer(WebCore::ImageBuffer&, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&) + 90 (GraphicsContext.cpp:695) 13 WebCore 0x152d4115b WebCore::DisplayList::DrawImageBuffer::apply(WebCore::GraphicsContext&, WebCore::ImageBuffer&) const + 59 (DisplayListItems.cpp:371) 14 WebKit 0x11fd7e542 void WebKit::RemoteDisplayListRecorder::handleItem<WebCore::DisplayList::DrawImageBuffer, WebCore::ImageBuffer&>(WebCore::DisplayList::DrawImageBuffer&&, WebCore::ImageBuffer&) + 66 (RemoteDisplayListRecorder.h:149) 15 WebKit 0x11fd7e4de WebKit::RemoteDisplayListRecorder::drawImageBufferWithQualifiedIdentifier(WebCore::ProcessQualified<WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType> >, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&) + 270 (RemoteDisplayListRecorder.cpp:265) 16 WebKit 0x11fd7e3ca WebKit::RemoteDisplayListRecorder::drawImageBuffer(WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&) + 90 (RemoteDisplayListRecorder.cpp:254) 17 WebKit 0x11fb03925 void IPC::callMemberFunctionImpl<WebKit::RemoteDisplayListRecorder, void (WebKit::RemoteDisplayListRecorder::*)(WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect, WebCore::FloatRect, WebCore::ImagePaintingOptions>, 0ul, 1ul, 2ul, 3ul>(WebKit::RemoteDisplayListRecorder*, void (WebKit::RemoteDisplayListRecorder::*)(WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect, WebCore::FloatRect, WebCore::ImagePaintingOptions>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>) + 229 (HandleMessage.h:125) 18 WebKit 0x11fb0182d void IPC::callMemberFunction<WebKit::RemoteDisplayListRecorder, void (WebKit::RemoteDisplayListRecorder::*)(WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect, WebCore::FloatRect, WebCore::ImagePaintingOptions>, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul> >(std::__1::tuple<WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect, WebCore::FloatRect, WebCore::ImagePaintingOptions>&&, WebKit::RemoteDisplayListRecorder*, void (WebKit::RemoteDisplayListRecorder::*)(WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&)) + 109 (HandleMessage.h:131) 19 WebKit 0x11faca341 void IPC::handleMessage<Messages::RemoteDisplayListRecorder::DrawImageBuffer, WebKit::RemoteDisplayListRecorder, void (WebKit::RemoteDisplayListRecorder::*)(WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&)>(IPC::Connection&, IPC::Decoder&, WebKit::RemoteDisplayListRecorder*, void (WebKit::RemoteDisplayListRecorder::*)(WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>, WebCore::FloatRect const&, WebCore::FloatRect const&, WebCore::ImagePaintingOptions const&)) + 225 (HandleMessage.h:196) 20 WebKit 0x11fac7abf WebKit::RemoteDisplayListRecorder::didReceiveStreamMessage(IPC::StreamServerConnectionBase&, IPC::Decoder&) + 2639 (RemoteDisplayListRecorderMessageReceiver.cpp:107) 21 WebKit 0x12053abab IPC::StreamServerConnection::dispatchStreamMessage(IPC::Decoder&&, IPC::StreamMessageReceiver&) + 139 (StreamServerConnection.cpp:254) 22 WebKit 0x12053a544 IPC::StreamServerConnection::dispatchStreamMessages(unsigned long) + 964 (StreamServerConnection.cpp:229) 23 WebKit 0x120538f04 IPC::StreamConnectionWorkQueue::processStreams() + 452 (StreamConnectionWorkQueue.cpp:135) 24 WebKit 0x120540bf0 IPC::StreamConnectionWorkQueue::startProcessingThread()::$_0::operator()() + 32 (StreamConnectionWorkQueue.cpp:107) 25 WebKit 0x120540ba9 WTF::Detail::CallableWrapper<IPC::StreamConnectionWorkQueue::startProcessingThread()::$_0, void>::call() + 25 (Function.h:53) 26 JavaScriptCore 0x132b503b2 WTF::Function<void ()>::operator()() const + 130 27 JavaScriptCore 0x132c152e8 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 408 Thread 8:: RemoteGraphicsContextGL work queue 0 libsystem_kernel.dylib 0x7ff80c7639d6 semaphore_wait_trap + 10 1 WebKit 0x120588e38 IPC::Semaphore::wait() + 24 (IPCSemaphoreDarwin.cpp:77) 2 WebKit 0x120540c26 IPC::StreamConnectionWorkQueue::startProcessingThread()::$_0::operator()() + 86 (StreamConnectionWorkQueue.cpp:112) 3 WebKit 0x120540ba9 WTF::Detail::CallableWrapper<IPC::StreamConnectionWorkQueue::startProcessingThread()::$_0, void>::call() + 25 (Function.h:53) 4 JavaScriptCore 0x132b503b2 WTF::Function<void ()>::operator()() const + 130 5 JavaScriptCore 0x132c152e8 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 408 6 JavaScriptCore 0x132c216d5 WTF::wtfThreadEntryPoint(void*) + 21 7 libsystem_pthread.dylib 0x7ff80c7a04bc _pthread_start + 120 8 libsystem_pthread.dylib 0x7ff80c79bebf thread_start + 15 1840813 1 webkit-bug-importer 2022-02-12 19:46:32 -0800 <rdar://problem/88862924> 1841630 2 452003 kkinnunen 2022-02-15 01:48:32 -0800 Created attachment 452003 Patch 1841654 3 452003 koivisto 2022-02-15 04:25:06 -0800 Comment on attachment 452003 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=452003&action=review > Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:261 > + // FIXME: This should not be needed. Maybe ArrayBufferView should be ThreadSafeRefCounted as it is used in accross multiple threads. > + // The call below is synchronous and we transfer the ownership of the `pixelBuffer`. > + if (pixelBuffer) > + pixelBuffer->data().disableThreadingChecks(); > m_renderingBackend->dispatch([&, contextAttributes = m_context->contextAttributes()]() mutable { The ownership transfer here is not super obvious in the code. 1841660 4 ews-feeder 2022-02-15 05:11:49 -0800 Committed r289802 (247267@main): <https://commits.webkit.org/247267@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 452003. 452003 2022-02-15 01:48:32 -0800 2022-02-15 05:11:50 -0800 Patch bug-236501-20220215114831.patch text/plain 2487 kkinnunen U3VidmVyc2lvbiBSZXZpc2lvbjogMjg5NzkzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDJmODdlMjY1MGI3OWM3ZTMx NWM4NzAxMzQ5MGFmNmQ3NDUzMTM4ODguLjdkNWU3ZWVlMzZlYmQxNjc3YzEyZjZjMjFlNzY2NTA3 NjI4MDBmZTAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjAgQEAKKzIwMjItMDItMTUgIEtpbW1vIEtp bm51bmVuICA8a2tpbm51bmVuQGFwcGxlLmNvbT4KKworICAgICAgICBHUFVQIFdlYkdMOiBXVEY6 OlJlZkNvdW50ZWRCYXNlOjphcHBseVJlZkRlcmVmVGhyZWFkaW5nQ2hlY2soKSBmYWlscyBkdWUg dG8gUmVtb3RlR3JhcGhpY3NDb250ZXh0R0w6OnBhaW50UGl4ZWxCdWZmZXJUb0ltYWdlQnVmZmVy CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzY1MDEK KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBObyBuZXcg dGVzdHMsIHRlc3RlZCBieSBleGlzdGluZyBXZWJHTCBjb25mb3JtYW5jZSB0ZXN0cyB3aGljaCBm YWlsIGZyb20gdGltZSB0byB0aW1lIHdpdGggdGhlIGFzc2VydGlvbi4KKworICAgICAgICBBdm9p ZCBhc3NlcnRpb24gYWJvdXQgY3Jvc3MtdGhyZWFkIGRlcmVmIG9uIEFycmF5QnVmZmVyVmlldyBv d25lZCBieSBQaXhlbEJ1ZmZlci4gVGhlIFBpeGVsQnVmZmVyCisgICAgICAgIGlzIHBhc3NlZCB0 byBSZW1vdGVSZW5kZXJpbmdCYWNrZW5kIHRocmVhZCBmb3IgZHJhd2luZyBhbmQgdGhlbiBkZWFs bG9jYXRlZCB0aGVyZS4gSW4gdGhpcyB1c2UtY2FzZQorICAgICAgICBubyBvdGhlciByZWZlcm5l Y2VzIHRvIHRoZSBBcnJheUJ1ZmZlclZpZXcgZXhpc3QgYW5kIHRoZSBQaXhlbEJ1ZmZlciBpcyBt b3ZlZCwgc28gaXQgaXMgc2FmZSB0bworICAgICAgICBkaXNhYmxlIHRoZSBjcm9zcy10aHJlYWQg ZGVyZWYgYXNzZXJ0aW9uLgorCisgICAgICAgICogR1BVUHJvY2Vzcy9ncmFwaGljcy9SZW1vdGVH cmFwaGljc0NvbnRleHRHTC5jcHA6CisgICAgICAgIChXZWJLaXQ6OlJlbW90ZUdyYXBoaWNzQ29u dGV4dEdMOjpwYWludFBpeGVsQnVmZmVyVG9JbWFnZUJ1ZmZlcik6CisKIDIwMjItMDItMTUgIEtp bW1vIEtpbm51bmVuICA8a2tpbm51bmVuQGFwcGxlLmNvbT4KIAogICAgICAgICBBTkdMRSBpbmNs dWRlcyBpbnRlcmZlcmUgd2l0aCBzeXN0ZW0gaGVhZGVyIGluY2x1ZGVzCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViS2l0L0dQVVByb2Nlc3MvZ3JhcGhpY3MvUmVtb3RlR3JhcGhpY3NDb250ZXh0R0wu Y3BwIGIvU291cmNlL1dlYktpdC9HUFVQcm9jZXNzL2dyYXBoaWNzL1JlbW90ZUdyYXBoaWNzQ29u dGV4dEdMLmNwcAppbmRleCAwZGFmZGM2MDhhZWE3OWNiNzc3Yjc0NTg4MTkyMjhlMmEzZTg4NmJj Li4wNGNhMTBlMThmMTUwODE1ZjNmZDY5M2ZmYjMyNjk1MzQyMjdkOTZhIDEwMDY0NAotLS0gYS9T b3VyY2UvV2ViS2l0L0dQVVByb2Nlc3MvZ3JhcGhpY3MvUmVtb3RlR3JhcGhpY3NDb250ZXh0R0wu Y3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvR1BVUHJvY2Vzcy9ncmFwaGljcy9SZW1vdGVHcmFwaGlj c0NvbnRleHRHTC5jcHAKQEAgLTI1Myw2ICsyNTMsMTEgQEAgdm9pZCBSZW1vdGVHcmFwaGljc0Nv bnRleHRHTDo6cGFpbnRQaXhlbEJ1ZmZlclRvSW1hZ2VCdWZmZXIoc3RkOjpvcHRpb25hbDxXZWJD b3IKICAgICBMb2NrIGxvY2s7CiAgICAgQ29uZGl0aW9uIGNvbmRpdGlvblZhcmlhYmxlOwogICAg IGJvb2wgaXNGaW5pc2hlZCA9IGZhbHNlOworCisgICAgLy8gRklYTUU6IFRoaXMgc2hvdWxkIG5v dCBiZSBuZWVkZWQuIE1heWJlIEFycmF5QnVmZmVyVmlldyBzaG91bGQgYmUgVGhyZWFkU2FmZVJl ZkNvdW50ZWQgYXMgaXQgaXMgdXNlZCBpbiBhY2Nyb3NzIG11bHRpcGxlIHRocmVhZHMuCisgICAg Ly8gVGhlIGNhbGwgYmVsb3cgaXMgc3luY2hyb25vdXMgYW5kIHdlIHRyYW5zZmVyIHRoZSBvd25l cnNoaXAgb2YgdGhlIGBwaXhlbEJ1ZmZlcmAuCisgICAgaWYgKHBpeGVsQnVmZmVyKQorICAgICAg ICBwaXhlbEJ1ZmZlci0+ZGF0YSgpLmRpc2FibGVUaHJlYWRpbmdDaGVja3MoKTsKICAgICBtX3Jl bmRlcmluZ0JhY2tlbmQtPmRpc3BhdGNoKFsmLCBjb250ZXh0QXR0cmlidXRlcyA9IG1fY29udGV4 dC0+Y29udGV4dEF0dHJpYnV0ZXMoKV0oKSBtdXRhYmxlIHsKICAgICAgICAgaWYgKGF1dG8gaW1h Z2VCdWZmZXIgPSBtX3JlbmRlcmluZ0JhY2tlbmQtPnJlbW90ZVJlc291cmNlQ2FjaGUoKS5jYWNo ZWRJbWFnZUJ1ZmZlcih0YXJnZXQpKSB7CiAgICAgICAgICAgICAvLyBIZXJlIHdlIGRvIG5vdCB0 cnkgdG8gcGxheSBiYWNrIHBlbmRpbmcgY29tbWFuZHMgZm9yIGltYWdlQnVmZmVyLiBDdXJyZW50 bHkgdGhpcyBjYWxsIGlzIG9ubHkgbWFkZSBmb3IgZW1wdHkK