Bug 292758

Summary:	REGRESSION ( 294005@main): [ iOS Debug ] ASSERTION FAILED: !isInGPUProcess() system-preview/badge.html is a cosnsitent crash
Product:	WebKit	Reporter:	Jay Stfleur <j_stfleur>
Component:	New Bugs	Assignee:	Mike Wyrzykowski <mwyrzykowski>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	graouts, mwyrzykowski, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Jay Stfleur

Reported 2025-05-08 20:13:20 PDT

Description: system-preview/badge.html regression happened after changes on 294005@main on iOS Debug. The method WebCore::ARKitBadgeSystemImage::draw is attempting to draw a system image inside the GPU process, which is explicitly disallowed. The assertion !isInGPUProcess() means this drawing logic must not be run from the GPU process, yet it is. Which leads to the crash. Buildbot URL: https://build.webkit.org/#/builders/1392/builds/807 History: https://results.webkit.org/?suite=layout-tests&test=system-preview%2Fbadge.html&style=debug Diff/Image Diff/Crash Log: ASSERTION FAILED: !isInGPUProcess() /Volumes/Data/worker/Apple-iOS-18-Simulator-Debug-Build/build/Source/WebCore/Modules/system-preview/ARKitBadgeSystemImage.mm(196) : virtual void WebCore::ARKitBadgeSystemImage::draw(GraphicsContext &, const FloatRect &) const 1 0x14618cab0 WebCore::ARKitBadgeSystemImage::draw(WebCore::GraphicsContext&, WebCore::FloatRect const&) const 2 0x14b92a1f4 WebCore::GraphicsContext::drawSystemImage(WebCore::SystemImage&, WebCore::FloatRect const&) 3 0x131b70bd0 WebKit::RemoteDisplayListRecorder::drawSystemImage(WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect const&) 4 0x1308238fc auto void IPC::callMemberFunction<WebKit::RemoteDisplayListRecorder, WebKit::RemoteDisplayListRecorder, void (WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect const&), std::__1::tuple<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>>(WebKit::RemoteDisplayListRecorder*, void (WebKit::RemoteDisplayListRecorder::*)(WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect const&), std::__1::tuple<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>&&)::'lambda'(auto&&...)::operator()<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>(auto&&...) const 5 0x130823810 decltype(std::declval<WebKit::RemoteDisplayListRecorder>()(std::declval<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>>(), std::declval<WebCore::FloatRect>())) std::__1::__invoke[abi:sn180100]<void IPC::callMemberFunction<WebKit::RemoteDisplayListRecorder, WebKit::RemoteDisplayListRecorder, void (WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect const&), std::__1::tuple<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>>(WebKit::RemoteDisplayListRecorder*, void (WebKit::RemoteDisplayListRecorder::*)(WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect const&), std::__1::tuple<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>&&)::'lambda'(auto&&...), WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>(WebKit::RemoteDisplayListRecorder&&, WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect&&) 6 0x1308237dc decltype(auto) std::__1::__apply_tuple_impl[abi:sn180100]<void IPC::callMemberFunction<WebKit::RemoteDisplayListRecorder, WebKit::RemoteDisplayListRecorder, void (WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect const&), std::__1::tuple<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>>(WebKit::RemoteDisplayListRecorder*, void (WebKit::RemoteDisplayListRecorder::*)(WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>&&, WebCore::FloatRect const&), std::__1::tuple<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>&&)::'lambda'(auto&&...), std::__1::tuple<WTF::Ref<WebCore::SystemImage, WTF::RawPtrTraits<WebCore::SystemImage>, WTF::DefaultRefDerefTraits<WebCore::SystemImage>>, WebCore::FloatRect>, 0ul, 1ul>(WebKit::RemoteDisplayListRecorder&&,

Attachments
Add attachment proposed patch, testcase, etc.

EWS

Comment 1 2025-05-08 20:25:14 PDT

Test gardening commit 294698@main (ace9e7c6702f): <https://commits.webkit.org/294698@main> Reviewed commits have been landed. Closing PR #45145 and removing active labels.

Radar WebKit Bug Importer

Comment 2 2025-05-09 17:10:10 PDT

<rdar://problem/151044237>

Mike Wyrzykowski

Comment 3 2025-05-09 17:11:12 PDT

We can restore the path for the GPU process code path and keep the branch

Mike Wyrzykowski

Comment 4 2025-05-09 17:11:18 PDT

We can restore the path for the GPU process code path and keep the branch

Mike Wyrzykowski

Comment 5 2025-05-09 17:13:19 PDT

The code works in the GPU process, so this is a debug only crash. No one was aware of a code path which reached this from GPU process

Mike Wyrzykowski

Comment 6 2025-05-09 20:04:23 PDT

Pull request: https://github.com/WebKit/WebKit/pull/45202

EWS

Comment 7 2025-05-12 10:18:29 PDT

Committed 294793@main (02759c934d08): <https://commits.webkit.org/294793@main> Reviewed commits have been landed. Closing PR #45202 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.