Have HTMLCanvasElement clear its buffer as soon as its script execution context goes away. We used to do this only in the destructor, which would only get called after GC of the JS wrapper, which may delay release of the ImageBuffer and its memory.
Created attachment 425896 [details] Patch
Created attachment 425906 [details] Patch
This is web-observable.
Comment on attachment 425906 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=425906&action=review Additional motivation: https://bugs.webkit.org/show_bug.cgi?id=228747 > Source/WebCore/html/HTMLCanvasElement.cpp:1028 > + setImageBuffer(nullptr); I'm guessing we'd need to slurp some more code from the destructor to fix the assertions.
Reopening because Sam and Chris and I all think we should try this again when we have lots of bake time :) (Also, we already do it for WebGL)
<rdar://problem/91563038>