commit 56a361335cd8907e0d3385504cd6bd5e4b3eceaf
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Mar 18 12:18:00 2022 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Mar 18 12:18:00 2022 +0000
tree 75af59f53c47f6ac6049fb61c5e31ad6f66829a4
parent bff24952e38a07486618be71ac79875973263278

Recycling a webgl context when it has been lost and restored causes a crash
https://bugs.webkit.org/show_bug.cgi?id=238024

Patch by Kimmo Kinnunen <kkinnunen@apple.com> on 2022-03-18
Reviewed by Geoffrey Garen.

Source/WebCore:

Simulated context lost makes WebGLRenderingContextBase::m_context = nullptr
Real context lost preserves WebGLRenderingContextBase::m_context.

WebGLRenderingContextBase::maybeRestoreContext() used m_context.

The intention was that simulated context lost never invokes maybeRestoreContext()
as the timer to run maybeRestoreContext() is started only on real context lost.

However, it is possible to invoke simulated context lost after a real context lost,
but before the timer triggers maybeRestoreContext().

The sequence would be:
1. Lose the context somehow
2. Wait for webglcontextlost, use event.preventDefault() to request a restore.
3. Before restore happens, lose the context via simulated context lost.
   This can be done by creating many contexts or via the WEBGL_lose_context.loseContext().
4. maybeRestoreContext() would query m_context->getGraphicsResetStatusARB() for
   console log reasons, trying to explain to the developer why the context was lost.
   In case simulated context lost set the m_context == nullptr, this would crash.

getGraphicsResetStatusARB() has likely not been accurate for any platform ever.
For ANGLE, it is unimplemented and cannot pinpoint which context caused the context lost.
Just remove getGraphicsResetStatusARB() use from maybeRestoreContext(), this prevents
the crash. Remove it also from WebKit use altogether, it is never used for anything.

Adds the case to webgl/max-active-contexts-webglcontextlost-prevent-default.html

* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::loseContextImpl):
(WebCore::WebGLRenderingContextBase::maybeRestoreContext):
* loader/FrameLoaderClient.h:
* platform/graphics/GraphicsContextGL.h:
* platform/graphics/angle/GraphicsContextGLANGLE.cpp:
* platform/graphics/angle/GraphicsContextGLANGLE.h:
* platform/graphics/opengl/ExtensionsGLOpenGLCommon.cpp:
* platform/graphics/opengl/ExtensionsGLOpenGLCommon.h:
* platform/graphics/opengl/ExtensionsGLOpenGLES.cpp:
* platform/graphics/opengl/ExtensionsGLOpenGLES.h:
* platform/graphics/opengl/GraphicsContextGLOpenGL.cpp:
* platform/graphics/opengl/GraphicsContextGLOpenGL.h:

Source/WebKit:

Remove GraphicsContextGL::getGraphicsResetStatusARB(), it's unused now.

* GPUProcess/graphics/RemoteGraphicsContextGL.messages.in:
* GPUProcess/graphics/RemoteGraphicsContextGLFunctionsGenerated.h:
(getActiveUniformBlockiv):
* WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.cpp:
(WebKit::RemoteGraphicsContextGLProxy::paintRenderingResultsToCanvas):
(WebKit::RemoteGraphicsContextGLProxy::paintCompositedResultsToCanvas):
(WebKit::RemoteGraphicsContextGLProxy::markContextLost):
* WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.h:
* WebProcess/GPU/graphics/RemoteGraphicsContextGLProxyFunctionsGenerated.cpp:

LayoutTests:

Creating excessive amount of contexts will lose the oldest context via
"simulated context lost" logic, making the contexts non-restorable.

Previously the test tried to test that requesting a restore on a context that
had simulated context lost would not restore. However, the test was invalid,
as it asserted that the context is still lost immediately after preventDefault():

  event.preventDefault();
  if (!contexts[0].isContextLost())
     document.getElementById("result").textContent = "FAIL";

This is not correct, as the preventDefault() only informs the browser
that the context should be restored. The restore happens asynchronously.

Fix the test logic and add extra cases. Make the logic as such:
1. Lose the context in some way
2. Wait for context lost event, request restore
3. Optionally do something that would trigger another way of losing the context
4. Run assertions about context being still expectedly lost

The failures in the test expectation:
FAIL getError expected: INVALID_OPERATION. Was NO_ERROR :
FAIL getError expected: CONTEXT_LOST_WEBGL. Was NO_ERROR :
bug 236965

FAIL Expected restore be ignored, but it was not.
bug 238034

* webgl/max-active-contexts-webglcontextlost-prevent-default.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@291477 268f45cc-cd09-0410-ab3c-d52691b4dbfc