Fix arena double-release on ordered flush failure and harden disposal

An exception during an ordered flush skipped copying the executor's replacement
arenas back to the caller, so the finally returned already-disposed arenas to
the reuse caches; a later drain then released their buffers a second time,
corrupting native memory. Arenas now copy back unconditionally, and both arena
types dispose behind an interlocked flag, nulling each buffer so a stale
reference fails CanReuse instead of touching freed memory.

Disposal is hardened across both projects: guard flags set before releases,
exception-safe multi-buffer creation, per-entry isolation in the deferred
status harvest, retained-scene item release on the empty and exception paths
of scene creation, root/region canvases sharing one deferred-image list, and
decoration ink buffers owned by the glyph builder base with a chained virtual
dispose.

Software adapters are rejected at adapter selection via wgpuAdapterGetInfo;
GPU-less environments are served by the CPU backend. The staged submission,
dispatch, and scene-render probes and the ForceFallbackAdapter option are
removed along with the CI diagnostic capture.

Author: JimBobSquarePants

.github/workflows/build-and-test.yml

@@ -208,32 +208,6 @@ jobs:
           SIXLABORS_TESTING_PREVIEW: True
           XUNIT_PATH: .\tests\ImageSharp.Drawing.Tests # Required for xunit
 
-      # Diagnostic capture for the WARP-only native fault: reruns the WebGPU suite with the
-      # support probe bypassed so the fault can occur, collecting crash dumps as artifacts.
-      # Never affects job status; remove once the fault is root-caused upstream.
-      - name: WebGPU WARP Diagnostic
-        if: ${{ runner.os == 'Windows' && matrix.options.sdk-preview != true }}
-        continue-on-error: true
-        timeout-minutes: 12
-        shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Force warp-dumps | Out-Null
-          dotnet test tests/ImageSharp.Drawing.Tests -c Release -f ${{matrix.options.framework}} --filter "FullyQualifiedName~WebGPUDrawingBackendTests"
-        env:
-          SIXLABORS_TESTING: True
-          SIXLABORS_WEBGPU_PROBE_BYPASS: 1
-          DOTNET_DbgEnableMiniDump: 1
-          DOTNET_DbgMiniDumpType: 2
-          DOTNET_DbgMiniDumpName: ${{ github.workspace }}\warp-dumps\webgpu-crash-%p.dmp
-
-      - name: Export WebGPU Diagnostic Dumps
-        uses: actions/upload-artifact@v7
-        if: ${{ always() && runner.os == 'Windows' && matrix.options.sdk-preview != true }}
-        with:
-          name: webgpu_warp_dumps_${{ matrix.options.framework }}
-          path: warp-dumps/
-          if-no-files-found: ignore
-
       - name: Export Failed Output
         uses: actions/upload-artifact@v7
         if: failure()

src/ImageSharp.Drawing.WebGPU/WebGPU.cs

@@ -92,6 +92,22 @@ public void AdapterRequestDevice(
     public WGPUStatus AdapterGetLimits(WGPUAdapterImpl* adapter, WGPULimits* limits)
         => WebGPUNative.wgpuAdapterGetLimits(adapter, limits);
 
+    /// <summary>
+    /// Queries an adapter's identity and classification.
+    /// </summary>
+    /// <param name="adapter">The adapter to query.</param>
+    /// <param name="info">Receives the adapter info; release with <see cref="AdapterInfoFreeMembers"/>.</param>
+    /// <returns>The query status.</returns>
+    public WGPUStatus AdapterGetInfo(WGPUAdapterImpl* adapter, WGPUAdapterInfo* info)
+        => WebGPUNative.wgpuAdapterGetInfo(adapter, info);
+
+    /// <summary>
+    /// Releases the allocated string members of an adapter info value.
+    /// </summary>
+    /// <param name="info">The adapter info whose members are released.</param>
+    public void AdapterInfoFreeMembers(WGPUAdapterInfo info)
+        => WebGPUNative.wgpuAdapterInfoFreeMembers(info);
+
     /// <summary>
     /// Releases an adapter reference.
     /// </summary>

src/ImageSharp.Drawing.WebGPU/WebGPUDrawingBackend.Ordered.cs

@@ -59,10 +59,21 @@ private void RenderOrderedScene<TPixel>(
             resourceArena,
             schedulingArena);
 
-        executor.Execute();
-        currentBumpSizes = executor.BumpSizes;
-        resourceArena = executor.ResourceArena;
-        schedulingArena = executor.SchedulingArena;
+        try
+        {
+            executor.Execute();
+            currentBumpSizes = executor.BumpSizes;
+        }
+        finally
+        {
+            // The executor replaces its arenas in place when a range outgrows them, disposing
+            // the instances these ref slots still name. The copy-back must run on the failure
+            // path too: otherwise the caller's finally returns the disposed originals to the
+            // reuse caches (a later release then frees their buffers twice) and the live
+            // replacements held only by the executor leak.
+            resourceArena = executor.ResourceArena;
+            schedulingArena = executor.SchedulingArena;
+        }
     }
 
     /// <summary>
@@ -193,12 +204,23 @@ public WebGPUOrderedExecutor(
                     }
                 }
 
-                this.effectRenderer = new WebGPUEffectRenderer(
-                    flushContext,
-                    encodedScene.MaximumShaderEffectWidth,
-                    encodedScene.MaximumShaderEffectHeight,
-                    encodedScene.MaximumShaderUniformByteLength,
-                    maximumPassCount);
+                try
+                {
+                    this.effectRenderer = new WebGPUEffectRenderer(
+                        flushContext,
+                        encodedScene.MaximumShaderEffectWidth,
+                        encodedScene.MaximumShaderEffectHeight,
+                        encodedScene.MaximumShaderUniformByteLength,
+                        maximumPassCount);
+                }
+                catch
+                {
+                    // A ctor throw means the caller's using never binds, so Dispose cannot retire
+                    // the callback owner and event created above.
+                    this.mapCallback?.Dispose();
+                    this.mapReady?.Dispose();
+                    throw;
+                }
             }
         }
 

src/ImageSharp.Drawing.WebGPU/WebGPUDrawingBackend.cs

@@ -2,6 +2,7 @@
 // Licensed under the Six Labors Split License.
 
 using System.Runtime.CompilerServices;
+using System.Runtime.ExceptionServices;
 using SixLabors.ImageSharp.Drawing.Processing.Backends.Native;
 using SixLabors.ImageSharp.PixelFormats;
 
@@ -547,6 +548,14 @@ internal void ReturnArenas(
             // must be released immediately instead of being left for final backend disposal.
             WebGPUSceneResourceArena.Dispose(Interlocked.Exchange(ref this.cachedResourceArena, resourceArena));
         }
+
+        // Dispose can drain the cache between the guard above and these stores; sweep again
+        // so an arena parked after that drain cannot outlive the backend.
+        if (this.isDisposed)
+        {
+            WebGPUSceneSchedulingArena.Dispose(Interlocked.Exchange(ref this.cachedSchedulingArena, null));
+            WebGPUSceneResourceArena.Dispose(Interlocked.Exchange(ref this.cachedResourceArena, null));
+        }
     }
 
     /// <summary>
@@ -860,11 +869,17 @@ public void Dispose()
 
         // Retire deferred readbacks before their buffers. Each map is resolved or canceled here;
         // a callback that native WebGPU still owes remains self-rooted after a timeout and is
-        // prevented from entering the disposed readback owner.
-        this.HarvestPendingSchedulingStatuses(scene: null, drainAll: true);
-
-        WebGPUSceneSchedulingArena.Dispose(Interlocked.Exchange(ref this.cachedSchedulingArena, null));
-        WebGPUSceneResourceArena.Dispose(Interlocked.Exchange(ref this.cachedResourceArena, null));
+        // prevented from entering the disposed readback owner. The arena drain must run even
+        // when the harvest throws, or both cached arenas leak with no retry possible.
+        try
+        {
+            this.HarvestPendingSchedulingStatuses(null, true);
+        }
+        finally
+        {
+            WebGPUSceneSchedulingArena.Dispose(Interlocked.Exchange(ref this.cachedSchedulingArena, null));
+            WebGPUSceneResourceArena.Dispose(Interlocked.Exchange(ref this.cachedResourceArena, null));
+        }
     }
 
     /// <summary>
@@ -942,6 +957,11 @@ private void HarvestPendingSchedulingStatuses(WebGPUDrawingBackendScene? scene,
             return;
         }
 
+        // Entries were already removed from the queue above, so a failure on one entry must not
+        // abandon the rest: every remaining status would leak its readback buffer and its scene
+        // reference, leaving the scene's deferred teardown permanently blocked. The first
+        // failure is rethrown after every entry has been retired.
+        Exception? firstFailure = null;
         foreach (PendingSchedulingStatusEntry entry in due)
         {
             try
@@ -956,11 +976,21 @@ private void HarvestPendingSchedulingStatuses(WebGPUDrawingBackendScene? scene,
                     entry.CorrectiveRender?.Invoke();
                 }
             }
+            catch (Exception failure)
+            {
+                firstFailure ??= failure;
+                entry.Status.Dispose();
+            }
             finally
             {
                 entry.Scene?.ReleaseDeferredRenderReference();
             }
         }
+
+        if (firstFailure is not null)
+        {
+            ExceptionDispatchInfo.Capture(firstFailure).Throw();
+        }
     }
 
     /// <summary>

src/ImageSharp.Drawing.WebGPU/WebGPUEnvironmentError.cs

@@ -37,6 +37,12 @@ public enum WebGPUEnvironmentError
     /// </summary>
     AdapterRequestFailed,
 
+    /// <summary>
+    /// The only available adapter is a software rasterizer. Software adapters are not supported
+    /// by this backend; the CPU drawing backend serves GPU-less environments instead.
+    /// </summary>
+    SoftwareAdapterUnsupported,
+
     /// <summary>
     /// The device request callback did not complete before the timeout expired.
     /// </summary>

src/ImageSharp.Drawing.WebGPU/WebGPUEnvironmentOptions.cs

@@ -21,11 +21,4 @@ public sealed class WebGPUEnvironmentOptions
     /// Gets or sets the adapter power preference requested for the library-managed device.
     /// </summary>
     public WebGPUPowerPreference PowerPreference { get; set; } = WebGPUPowerPreference.HighPerformance;
-
-    /// <summary>
-    /// Gets or sets a value indicating whether adapter requests are restricted to the platform's
-    /// software fallback adapter, such as WARP on Windows. Software adapters match the rendering
-    /// environment of GPU-less continuous-integration machines.
-    /// </summary>
-    public bool ForceFallbackAdapter { get; set; }
 }

src/ImageSharp.Drawing.WebGPU/WebGPUFlushContext.cs

@@ -655,6 +655,11 @@ public void Dispose()
             return;
         }
 
+        // The flag is set before any release so a throw mid-teardown cannot leave a
+        // re-runnable context: a second Dispose over the still-populated lists would
+        // release every tracked object twice and double-return pooled rentals.
+        this.disposed = true;
+
         // Ordering: end any open passes before releasing the encoder they were recorded on,
         // then release the encoder before the transient objects it may still reference.
         this.EndComputePassIfOpen();
@@ -732,8 +737,6 @@ public void Dispose()
 
         this.pooledTextures.Clear();
         this.pooledUniformBuffers.Clear();
-
-        this.disposed = true;
     }
 
     /// <summary>

src/ImageSharp.Drawing.WebGPU/WebGPUPendingSchedulingStatus.cs

@@ -400,17 +400,25 @@ public void Dispose()
         // readback resources twice. The wrapper retains its own root if native still owes a call.
         this.disposed = true;
 
-        if (!this.resolved)
+        try
         {
-            // Give the accepted map a bounded opportunity to finish before releasing its buffer.
-            // A timeout is still safe because retiring the wrapper below suppresses a later call
-            // into this owner while its self-root preserves the native function target.
-            _ = this.TryResolve(out _);
+            if (!this.resolved)
+            {
+                // Give the accepted map a bounded opportunity to finish before releasing its buffer.
+                // A timeout is still safe because retiring the wrapper below suppresses a later call
+                // into this owner while its self-root preserves the native function target.
+                _ = this.TryResolve(out _);
+            }
+        }
+        finally
+        {
+            // A resolve throw (device poll or map-range failure) must not skip the retirement:
+            // the flag above already made this the only disposal pass, so the buffer, callback
+            // owner, and event would otherwise leak for the process lifetime.
+            this.ReleaseBuffer(unmap: false);
+            this.callback.Dispose();
+            this.mapReady.Dispose();
         }
-
-        this.ReleaseBuffer(unmap: false);
-        this.callback.Dispose();
-        this.mapReady.Dispose();
     }
 
     /// <summary>

src/ImageSharp.Drawing.WebGPU/WebGPURuntime.DeviceSharedState.cs

@@ -314,7 +314,7 @@ public DeviceSharedState(WebGPU api, WebGPUDeviceHandle deviceHandle)
         /// <summary>
         /// Gets the linear filtering sampler shared by layer-effect shader passes on this device.
         /// </summary>
-        public WGPUSamplerImpl* EffectFilteringSampler { get; }
+        public WGPUSamplerImpl* EffectFilteringSampler { get; private set; }
 
         /// <summary>
         /// Gets a value indicating whether the native runtime has reported this device as lost.
@@ -991,6 +991,7 @@ public void Dispose()
             this.effectPipelines.Clear();
 
             this.Api.SamplerRelease(this.EffectFilteringSampler);
+            this.EffectFilteringSampler = null;
 
             lock (this.statusReadbackSync)
             {