Bug 313643 – REGRESSION(309800@main): inspector/canvas/create-context-2d.html crashes due to WeakRef assertion in WebCore::InspectorCanvasAgent::internalEnable()

• Component: Canvas
• Status: RESOLVED FIXED

[Claudio Saavedra]

309800@main introduced threading assertions in WeakRef::get(), which is implicitly used in CanvasRenderingContext::canvasBase(), as it returns a CanvasBase& from a WeakRef<CanvasBase>. This is called from the wrong thread, causing the threading assertion to fail:

Thread 1 (Thread 0x7f8a89bff6c0 (LWP 379416)):
#0  WTFCrash () at ../../../Source/WTF/wtf/Assertions.cpp:380
#1  0x00007f8d4ac3430d in WTFCrashWithSecurityImplication () at ../../../Source/WTF/wtf/Assertions.cpp:409
#2  0x00007f8d5e993026 in WTF::WeakRef<WebCore::CanvasBase, WTF::DefaultWeakPtrImpl>::get (this=0x7f8d32281c50) at WTF/Headers/wtf/WeakRef.h:114
#3  0x00007f8d5e97bd4a in WTF::WeakRef<WebCore::CanvasBase, WTF::DefaultWeakPtrImpl>::operator WebCore::CanvasBase& (this=0x7f8d32281c50) at WTF/Headers/wtf/WeakRef.h:120
#4  0x00007f8d5e955974 in WebCore::CanvasRenderingContext::canvasBase (this=0x7f8d32281c20) at ../../../Source/WebCore/html/canvas/CanvasRenderingContext.h:66
#5  0x00007f8d63995741 in WebCore::InspectorCanvasAgent::internalEnable (this=0x7f8d32644440) at ../../../Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:165
#6  0x00007f8d6399543a in WebCore::InspectorCanvasAgent::enable (this=0x7f8d32644440) at ../../../Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:127
#7  0x00007f8d496fa080 in Inspector::CanvasBackendDispatcher::enable (this=0x7f8d3256c510, protocol_requestId=112) at JavaScriptCore/DerivedSources/inspector/InspectorBackendDispatchers.cpp:1175
#8  0x00007f8d496f9fbc in Inspector::CanvasBackendDispatcher::dispatch (this=0x7f8d3256c510, protocol_requestId=112, protocol_method=..., protocol_message=...) at JavaScriptCore/DerivedSources/inspector/InspectorBackendDispatchers.cpp:1163
#9  0x00007f8d496edf42 in Inspector::BackendDispatcher::dispatch (this=0x7f8d3246c300, message=...) at ../../../Source/JavaScriptCore/inspector/InspectorBackendDispatcher.cpp:190
#10 0x00007f8d63983ee8 in WebCore::WorkerInspectorController::dispatchMessageFromFrontend (this=0x7f8d323edda0, message=...) at ../../../Source/WebCore/inspector/WorkerInspectorController.cpp:191
#11 0x00007f8d65e7903c in operator() (__closure=0x7f8d324e4ff8, context=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope'
...) at ../../../Source/WebCore/workers/WorkerInspectorProxy.cpp:220
#12 0x00007f8d65eb38e2 in WTF::Detail::CallableWrapper<WebCore::WorkerInspectorProxy::sendMessageToWorkerInspectorController(const WTF::String&)::<lambda(WebCore::ScriptExecutionContext&)>, void, WebCore::ScriptExecutionContext&>::call(WebCore::ScriptExecutionContext &) (this=0x7f8d324e4ff0, in#0=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope'
...) at WTF/Headers/wtf/Function.h:59
#13 0x00007f8d60ded4ac in WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const (this=0x7f8d324b2dc0, in#0=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope'
...) at WTF/Headers/wtf/Function.h:103
#14 0x00007f8d617eb451 in WebCore::ScriptExecutionContext::Task::performTask (this=0x7f8d324b2dc0, context=warning: RTTI symbol not found for class 'WebCore::DedicatedWorkerGlobalScope'
...) at WebCore/PrivateHeaders/WebCore/ScriptExecutionContext.h:278
#15 0x00007f8d65ebaf2b in WebCore::WorkerDedicatedRunLoop::Task::performTask (this=0x7f8d324b2dc0, context=0x7f8a6e140000) at ../../../Source/WebCore/workers/WorkerRunLoop.cpp:411
#16 0x00007f8d65eba7c1 in WebCore::WorkerDedicatedRunLoop::runInMode (this=0x7f8d324c73c0, context=0x7f8a6e140000, predicate=...) at ../../../Source/WebCore/workers/WorkerRunLoop.cpp:327
#17 0x00007f8d65eb9d26 in WebCore::WorkerDedicatedRunLoop::run (this=0x7f8d324c73c0, context=0x7f8a6e140000) at ../../../Source/WebCore/workers/WorkerRunLoop.cpp:220
#18 0x00007f8d65eb7b8a in WebCore::WorkerOrWorkletThread::runEventLoop (this=0x7f8d3202e220) at ../../../Source/WebCore/workers/WorkerOrWorkletThread.cpp:110
#19 0x00007f8d65eb807c in WebCore::WorkerOrWorkletThread::workerOrWorkletThread (this=0x7f8d3202e220) at ../../../Source/WebCore/workers/WorkerOrWorkletThread.cpp:184
#20 0x00007f8d65ebef91 in operator() (__closure=0x7f8d32438248) at ../../../Source/WebCore/workers/WorkerThread.cpp:136
#21 0x00007f8d65eee970 in WTF::Detail::CallableWrapper<WebCore::WorkerThread::createThread()::<lambda()>, void>::call(void) (this=0x7f8d32438240) at WTF/Headers/wtf/Function.h:59
#22 0x00007f8d49011c52 in WTF::Function<void ()>::operator()() const (this=0x7f8a89bfe6f8) at WTF/Headers/wtf/Function.h:103
#23 0x00007f8d4ae0191c in WTF::Thread::entryPoint (newThreadContext=0x7f8d324c7420) at ../../../Source/WTF/wtf/Threading.cpp:258
#24 0x00007f8d4aeeade8 in WTF::wtfThreadEntryPoint (context=0x7f8d324c7420) at ../../../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:245
#25 0x00007f8d4c88aaa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#26 0x00007f8d4c917c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

[Claudio Saavedra]

https://results.webkit.org/?suite=layout-tests&test=inspector%2Fcanvas%2Fcreate-context-2d.html&style=debug

[Claudio Saavedra]

Pull request: https://github.com/WebKit/WebKit/pull/63890

[EWS]

Committed 312362@main (cbb066bf78fc): <https://commits.webkit.org/312362@main>

Reviewed commits have been landed. Closing PR #63890 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/175941841>