Bug 126947

Summary: [WebGL] Crash due to forceLostContext
Product: WebKit Reporter: Brent Fulgham <bfulgham>
Component: WebGLAssignee: Brent Fulgham <bfulgham>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, commit-queue, dino, esprehn+autocc, gyuyoung.kim, kondapallykalyan, roger_fong
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on: 104733    
Bug Blocks:    
Attachments:
Description Flags
Patch dino: review+

Description Brent Fulgham 2014-01-13 16:30:15 PST
When a frame containing a WebGL context is detached, the WebGL context receives a call to stopActiveDOMObjects, which results in the WebGLRenderingContext::stop() method being called.

This causes the underlying OpenGL context to be destroyed.

If this destruction takes place as part of the replacement of a node with new HTML, this "in-destruction" node can be asked to adjust its style as part of layout. This causes RenderLayerBacking::updateGraphicsLayerConfiguration() to attempt to use the underlying OpenGL context, causing a crash.

The simplest resolution would be the following change:

Index: html/canvas/WebGLRenderingContext.cpp
===================================================================
--- html/canvas/WebGLRenderingContext.cpp	(revision 161907)
+++ html/canvas/WebGLRenderingContext.cpp	(working copy)
@@ -4733,7 +4733,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 PlatformLayer* WebGLRenderingContext::platformLayer() const
 {
-    return m_context->platformLayer();
+    return (m_context) ? m_context->platformLayer() : 0;
 }
 #endif

However, this additional null check for every "platformLayer()" access might be too expensive.
Comment 1 Brent Fulgham 2014-01-13 16:43:34 PST
Test coverage in webgl/conformance/textures/origin-clean-conformance.html.
Comment 2 Brent Fulgham 2014-01-13 16:43:45 PST
<rdar://problem/8622625>
Comment 3 Brent Fulgham 2014-01-13 16:46:03 PST
Created attachment 221089 [details]
Patch
Comment 4 Brent Fulgham 2014-01-13 16:57:01 PST
Committed r161924: <http://trac.webkit.org/changeset/161924>