[Webkit-unassigned] [Bug 280214] Debug assertion on https://www.browserbench.org/MotionMark1.3.1/developer.html

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=280214

--- Comment #1 from Nikolas Zimmermann <zimmermann at kde.org> ---
I can reproduce it every time on WPE, with threaded CPU rendering activated, when clicking on the 'Run Benchmark' button.

I checked how ControlParts are created:
RenderBox::paintBoxDecorations() calls RenderBox::ensureControlPartForRenderer(), which calls RenderBox::ensureControlPart(), which in turns calls theme().createControlPart() which creates a ToggleButtonPart object for the 'Run benchmark' button.

In the threaded CPU rendering case, the ControlPart creation happens from within the worker thread, when we replay the previously recorded DisplayList (recording happened on the main thread).

As can be seen from the backtrace, the destruction of the RenderObjectRareData, and thus the ToggleButtonPart was triggered from the main thread during layout / style resolving.

Since ControlPart is not ThreadSafeRefCounted, the assertion popped up.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240924/2a20c234/attachment.htm>