313643 2026-04-29 05:43:45 -0700 REGRESSION(309800@main): inspector/canvas/create-context-2d.html crashes due to WeakRef assertion in WebCore::InspectorCanvasAgent::internalEnable() 2026-04-30 07:16:14 -0700 1 1 1 Unclassified WebKit Canvas WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 csaavedra csaavedra cdumez sabouhallawa webkit-bug-importer oldest_to_newest 2205738 0 csaavedra 2026-04-29 05:43:45 -0700 309800@main introduced threading assertions in WeakRef::get(), which is implicitly used in CanvasRenderingContext::canvasBase(), as it returns a CanvasBase& from a WeakRef<CanvasBase>. This is called from the wrong thread, causing the threading assertion to fail: Thread 1 (Thread 0x7f8a89bff6c0 (LWP 379416)): #0 WTFCrash () at ../../../Source/WTF/wtf/Assertions.cpp:380 #1 0x00007f8d4ac3430d in WTFCrashWithSecurityImplication () at ../../../Source/WTF/wtf/Assertions.cpp:409 #2 0x00007f8d5e993026 in WTF::WeakRef<WebCore::CanvasBase, WTF::DefaultWeakPtrImpl>::get (this=0x7f8d32281c50) at WTF/Headers/wtf/WeakRef.h:114 #3 0x00007f8d5e97bd4a in WTF::WeakRef<WebCore::CanvasBase, WTF::DefaultWeakPtrImpl>::operator WebCore::CanvasBase& (this=0x7f8d32281c50) at WTF/Headers/wtf/WeakRef.h:120 #4 0x00007f8d5e955974 in WebCore::CanvasRenderingContext::canvasBase (this=0x7f8d32281c20) at ../../../Source/WebCore/html/canvas/CanvasRenderingContext.h:66 #5 0x00007f8d63995741 in WebCore::InspectorCanvasAgent::internalEnable (this=0x7f8d32644440) at ../../../Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:165 #6 0x00007f8d6399543a in WebCore::InspectorCanvasAgent::enable (this=0x7f8d32644440) at ../../../Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:127 #7 0x00007f8d496fa080 in Inspector::CanvasBackendDispatcher::enable (this=0x7f8d3256c510, protocol_requestId=112) at JavaScriptCore/DerivedSources/inspector/InspectorBackendDispatchers.cpp:1175 #8 0x00007f8d496f9fbc in Inspector::CanvasBackendDispatcher::dispatch (this=0x7f8d3256c510, protocol_requestId=112, protocol_method=..., protocol_message=...) at JavaScriptCore/DerivedSources/inspector/InspectorBackendDispatchers.cpp:1163 #9 0x00007f8d496edf42 in Inspector::BackendDispatcher::dispatch (this=0x7f8d3246c300, message=...) at ../../../Source/JavaScriptCore/inspector/InspectorBackendDispatcher.cpp:190 #10 0x00007f8d63983ee8 in WebCore::WorkerInspectorController::dispatchMessageFromFrontend (this=0x7f8d323edda0, message=...) at ../../../Source/WebCore/inspector/WorkerInspectorController.cpp:191 #11 0x00007f8d65e7903c in operator() (__closure=0x7f8d324e4ff8, context=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope' ...) at ../../../Source/WebCore/workers/WorkerInspectorProxy.cpp:220 #12 0x00007f8d65eb38e2 in WTF::Detail::CallableWrapper<WebCore::WorkerInspectorProxy::sendMessageToWorkerInspectorController(const WTF::String&)::<lambda(WebCore::ScriptExecutionContext&)>, void, WebCore::ScriptExecutionContext&>::call(WebCore::ScriptExecutionContext &) (this=0x7f8d324e4ff0, in#0=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope' ...) at WTF/Headers/wtf/Function.h:59 #13 0x00007f8d60ded4ac in WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const (this=0x7f8d324b2dc0, in#0=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope' ...) at WTF/Headers/wtf/Function.h:103 #14 0x00007f8d617eb451 in WebCore::ScriptExecutionContext::Task::performTask (this=0x7f8d324b2dc0, context=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope' ...) at WebCore/PrivateHeaders/WebCore/ScriptExecutionContext.h:278 #15 0x00007f8d65ebaf2b in WebCore::WorkerDedicatedRunLoop::Task::performTask (this=0x7f8d324b2dc0, context=0x7f8a6e140000) at ../../../Source/WebCore/workers/WorkerRunLoop.cpp:411 #16 0x00007f8d65eba7c1 in WebCore::WorkerDedicatedRunLoop::runInMode (this=0x7f8d324c73c0, context=0x7f8a6e140000, predicate=...) at ../../../Source/WebCore/workers/WorkerRunLoop.cpp:327 #17 0x00007f8d65eb9d26 in WebCore::WorkerDedicatedRunLoop::run (this=0x7f8d324c73c0, context=0x7f8a6e140000) at ../../../Source/WebCore/workers/WorkerRunLoop.cpp:220 #18 0x00007f8d65eb7b8a in WebCore::WorkerOrWorkletThread::runEventLoop (this=0x7f8d3202e220) at ../../../Source/WebCore/workers/WorkerOrWorkletThread.cpp:110 #19 0x00007f8d65eb807c in WebCore::WorkerOrWorkletThread::workerOrWorkletThread (this=0x7f8d3202e220) at ../../../Source/WebCore/workers/WorkerOrWorkletThread.cpp:184 #20 0x00007f8d65ebef91 in operator() (__closure=0x7f8d32438248) at ../../../Source/WebCore/workers/WorkerThread.cpp:136 #21 0x00007f8d65eee970 in WTF::Detail::CallableWrapper<WebCore::WorkerThread::createThread()::<lambda()>, void>::call(void) (this=0x7f8d32438240) at WTF/Headers/wtf/Function.h:59 #22 0x00007f8d49011c52 in WTF::Function<void ()>::operator()() const (this=0x7f8a89bfe6f8) at WTF/Headers/wtf/Function.h:103 #23 0x00007f8d4ae0191c in WTF::Thread::entryPoint (newThreadContext=0x7f8d324c7420) at ../../../Source/WTF/wtf/Threading.cpp:258 #24 0x00007f8d4aeeade8 in WTF::wtfThreadEntryPoint (context=0x7f8d324c7420) at ../../../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:245 #25 0x00007f8d4c88aaa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447 #26 0x00007f8d4c917c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 2205739 1 csaavedra 2026-04-29 05:44:41 -0700 https://results.webkit.org/?suite=layout-tests&test=inspector%2Fcanvas%2Fcreate-context-2d.html&style=debug 2205742 2 csaavedra 2026-04-29 05:46:38 -0700 Pull request: https://github.com/WebKit/WebKit/pull/63890 2206240 3 ews-feeder 2026-04-30 07:15:41 -0700 Committed 312362@main (cbb066bf78fc): <https://commits.webkit.org/312362@main> Reviewed commits have been landed. Closing PR #63890 and removing active labels. 2206241 4 webkit-bug-importer 2026-04-30 07:16:14 -0700 <rdar://problem/175941841>