These two tests are following with the same stacktrace:
imported/w3c/web-platform-tests/html/canvas/offscreen/line-styles/2d.line.width.transformed.html [ Crash ]
imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.arc.selfintersect.1.worker.html [ Crash ]
First reported crash in test history is r267763. Exploring several revisions before, r267735 might be a likely cause for the failures.
Thread 1 (Thread 0x7fbff0b7e9c0 (LWP 99757)):
#0 0x00007fbffb2558f0 in WTF::Detail::CallableWrapper<WebCore::OffscreenCanvas::pushBufferToPlaceholder()::$_6, void>::call() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#4 0x00007fbff2f5704f in g_main_dispatch (context=0x1bd3970) at ../glib/gmain.c:3325
#5 g_main_context_dispatch (context=0x1bd3970) at ../glib/gmain.c:4016
#6 0x00007fbff2f573f8 in g_main_context_iterate (context=0x1bd3970, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4092
#7 0x00007fbff2f57713 in g_main_loop_run (loop=0x1c01c10) at ../glib/gmain.c:4290
#9 0x00007fbffa2dd87f in int WebKit::AuxiliaryProcessMain<WebKit::WebProcess, WebKit::WebProcessMainGtk>(int, char**) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#10 0x00007fbff1ab6022 in __libc_start_main (main=0x400c20 <main>, argc=4, argv=0x7ffed176fd68, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffed176fd58) at ../csu/libc-start.c:308
#11 0x0000000000400b5e in _start () at ../sysdeps/x86_64/start.S:120
Will investigate. I suspect a race on destruction.
The same is happening to imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.arc.selfintersect.1.html
Results db: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fhtml%2Fcanvas%2Foffscreen%2Fpath-objects%2F2d.path.arc.selfintersect.1.html
Gardened in r268892.
As I suspected, this is due to the script execution context being destroyed while the buffer is being pushed to the placeholder. I've got a fix that just involves holding a reference to the context while this is happening, but it feels ugly to me - I'll verify/tidy/upload and hopefully review will confirm whether this is a valid fix or not.
So I thought I had a fix, but it really just replaces the slightly more frequent crash with a much rarer, but still possible exception. Still looking into this, will see if I can get any advice on Slack if I can't come up with anything.
Created attachment 412417 [details]
As is often the case, I was overcomplicating things - there's no need to pass the OffscreenCanvas object to the main thread, instead I've moved all the placeholder canvas communication related data into a separate ThreadSafeRefCounted structure which we can safely use and release on the main thread. This removes the need to call back into the Worker thread to release a reference on the OffscreenCanvas and side-steps this issue entirely. Resolves the crashes in my local testing.
Created attachment 412427 [details]
Comment on attachment 412427 [details]
Should also re-enable the disabled tests...
Created attachment 412432 [details]
Committed r269046: <https://trac.webkit.org/changeset/269046>
All reviewed patches have been landed. Closing bug and clearing flags on attachment 412432 [details].