[Webkit-unassigned] [Bug 214765] New: [WebGL2] expando-loss and expando-loss-2 conformance tests are failing

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=214765

            Bug ID: 214765
           Summary: [WebGL2] expando-loss and expando-loss-2 conformance
                    tests are failing
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebGL
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: kbr at google.com
                CC: dino at apple.com
            Blocks: 126404, 189641, 189672

Per Bug 189641 and Bug 189672 the following two WebGL conformance tests are failing:

webgl/2.0.0/conformance/misc/expando-loss.html
webgl/2.0.0/conformance2/misc/expando-loss-2.html

the reason is that the WebGL rendering context maintains RefPtrs to objects which are latched into the OpenGL context state, but those implicitly retain weak pointers to their JavaScript wrappers.

https://trac.webkit.org/browser/webkit/trunk/Source/JavaScriptCore/heap/Strong.h appears to be designed to hold a strong reference to its target JavaScript object, and it is used in a select few places in WebCore - for example, https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/bindings/js/WorkerScriptController.h .

In order to fix the expando-loss failures, it seems likely that WebGLRenderingContextBase and WebGL2RenderingContext will have to retain strong references to the objects which are latched in to the context state, and which can be queried back from the context - like WebGLTextures, via bindTexture and getParameter(TEXTURE_BINDING_2D). In this case it seems the TextureUnitState will need to maintain Strong<JSWebGLTexture> instead of RefPtr<WebGLTexture>.

This will have to be carefully designed. Currently WebGLRenderingContextBase::m_contextObjects and WebGLContextGroup::m_groupObjects maintain weak downward references to all of the objects they allocated, and WebGLContextObject::m_context and WebGLSharedObject::m_contextGroup maintain weak upward references to the context which allocated them. Reference cycles must not be introduced.

A similar restructuring was done in Chromium in http://crbug.com/485634 . There was a significant bug tail associated with this change; a couple of the performance regressions were http://crbug.com/569668 and http://crbug.com/608576 . Care must be taken to not run into similar issues in WebCore.


Referenced Bugs:

https://bugs.webkit.org/show_bug.cgi?id=126404
[Bug 126404] WebGL 2 support
https://bugs.webkit.org/show_bug.cgi?id=189641
[Bug 189641] WebGL conformance: Failures and Timeouts in suite 2.0.0/conformance
https://bugs.webkit.org/show_bug.cgi?id=189672
[Bug 189672] WebGL conformance: Failures and Timeouts in suite 2.0.0/conformance2
-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200724/d29dedcb/attachment.htm>