Bug 276425 – [GTK] OffscreenCanvas transferred to worker causes crash

• Status: NEW
• Component: WebKitGTK

[Roope Salmi]

Created attachment 471862 [details]
HTML part

Ubuntu 22.04.4
WebKitGTK 2.45.4 or main, local build

Attached are two files: index.html and worker.js. Place them in the same directory and serve with "python3 -m http.server".

It transfers an OffscreenCanvas to a webworker, which then draws a square to the canvas repeatedly.

index.html:

<canvas id="c"></canvas>
<script>
    const width = 400;
    const height = 400;
    const osc = document.getElementById("c").transferControlToOffscreen();
    const worker = new Worker("worker.js");
    osc.width = width;
    osc.height = height;
    worker.postMessage(
	{"type": "init", "canvas": osc, "width": 400, "height": 400},
	[osc]
    );
    let counter = 0;
    function draw() {
	counter = (counter+1)%900;

	worker.postMessage({"type": "draw", "color": "#" + (counter + 100)});
	
	requestAnimationFrame(draw);
    }
    draw();
</script>

worker.js:

let canvas;
let ctx;
let width, height;
onmessage = (e) => {
    if (e.data["type"] == "init") {
	canvas = e.data["canvas"];
	ctx = canvas.getContext("2d");
	width = e.data["width"];
	height = e.data["height"];
    }
    if (e.data["type"] == "draw") {
	ctx.fillStyle = e.data["color"];
	ctx.fillRect(10, 10, 100, 100);
    }
}

After running for a few moments, the web process crashes.

In release builds, I get this message:

malloc(): unaligned tcache chunk detected

I'll try to compile with ASAN to get a more detailed report.

[Roope Salmi]

Created attachment 471863 [details]
JS web worker part

[Roope Salmi]

Address sanitizer build finished, but I get an error related to Skia immediately on startup, so I can't get anything useful out of it.