Bug 231157 – Safari crashes when GPU Process: Canvas Rendering is enabled with large paths

• Component: Canvas
• Status: NEW

Created attachment 440038 [details]
The page you need to open to get a safari crashed

0. It seems that since iOS v15 the option "GPU Process: Canvas Rendering" is enabled by default, but if it is disabled, go to setting and enable it explicitly
1. Open the page https://bl.ocks.org/timocov/raw/648966ce5c57492e82864b4d78a7c1cb/?raw=true (the same page in attachments or here https://gist.github.com/timocov/648966ce5c57492e82864b4d78a7c1cb)
2. Wait some time until the page is crashed

If you disable this page, everything will be good and no page crash.

On iOS 15.1 the issue still persist.

[Alexey Proskuryakov]

I can reproduce, getting this:

Requesting termination of web process 1779 for reason: "Detected invalid display list item or extent"

[Radar WebKit Bug Importer]

<rdar://problem/83842976>

Is it possible to disable this feature from iOS app somehow? We have a lot of users which are facing this issue in our app continuously and most likely the issue is not with what we render there. We’re continue getting negative reviews in the store because of that. Or maybe disable this feature in the following patch-release until all issues regarding this will be fixed?

[Brandon Liu]

Hi,

Thanks for creating this example page. I was able to modify it to be more specific, please see these links to 8 different test cases:

https://bdon.github.io/protomaps-experiments/safari15/

JavaScript code is here: https://github.com/bdon/protomaps-experiments/tree/master/safari15

In each frame it does 2 things:
1. it strokes or fills a path with N subpaths, where N can be controlled by the URL query parameter “count”. The subpaths are each a filled circle, a stroked line with 2 vertices, a triangle or a quad. 
2. It fillRects 1000 times with random height. This # of 1000 does not seem to matter.

For each case, there is an exact value of the # of subpaths N at which the hanging/crash will reproduce immediately; below this # there is no issue.

For arc filling, it hangs at 400 arcs
For line drawing, it hangs at 2728 lines
For triangles, it hangs at 1819 triangles
For quads, it hangs at 1364 quads

It seems like exactly 5,456 vertices in a single path draw call is causing the crash. If the 2nd part, 1000 fillRects, is left out, it also works fine. 

I can reproduce this perfectly on 3 devices of varying specs: x86 MacBook, iPhone XS and iPad Air 2.

[Cameron McCormack (:heycam)]

*** Bug 230751 has been marked as a duplicate of this bug. ***

[Wenson Hsieh]

This is fixed on trunk, after r284079.

[Brent Fulgham]

This change should be present in STP 139, iOS 15.4 Beta, and macOS 12.3 Beta.

[Brandon Liu]

Confirming that STP 139+ resolves this for us in both isolated test case and real-world application. Thank you WebKit team!