WebGPU/WebGL rendering

[cmdcolin]

This PR proposes a large change to help transition jbrowse 2 to a webgpu powered rendering system (with additional webgl and html5 canvas fallbacks)

See here for a couple demos
https://docs.google.com/document/d/11YIM9xtY4xBqQQjzvTyZ3sERMmh9sfclt14KwupS8dg/edit?usp=sharing

Background

JBrowse (both 1 and 2) have been "optimized for side scrolling". The "static blocks" based methodology reflects this: tiles of data are prerendered side by side. Unfortuantely, in order to get true smooth zooming, we need to re-think our rendering pipeline, and target gpu based rendering. The reason gpu is needed is that we can provide all the "coordinate data" to the GPU renderer, and the GPU just does transformations on zoom level changes or side scroll using fast minimal processing. Contrast this with html5 canvas, where on zoom level change, we have to completely, on the CPU, re-draw everything with javascript

Video

This video demo should be compelling to anyone who has ever zoomed in or out in jbrowse. It simply demonstrates smooth zooming. Compare against master where the entire screen blanks and re-renders at each zoom level, and the smooth zoom feels much more natural

out.mp4

Context

This was motivated by work with Pratik on the lorax project https://lorax.ucsc.edu/ this project is deeply webgl driven and is interested in integrating with jbrowse (meeting with Pratik later this week)

General approach: ensure that the dynamically selected callable (factory) is validated before invocation. Specifically, even though we already check truthiness, we should require that the looked-up value is a function. This prevents accidental invocation of non-function values if errorFactories is ever misconfigured, and satisfies CodeQL’s requirement for validating dynamic dispatch based on user-controlled keys.

Best concrete fix: in packages/core/src/rpc/serializeError/index.ts, inside newError(name: string), change the if (factory) { return factory() } guard so that it also verifies typeof factory === 'function'. If factory exists but is not a function, we should ignore it and fall back to the constructor logic already present, preserving existing behavior as much as possible while avoiding unsafe calls. No other behavior in the file needs to change, and we don’t need new imports or types.

Specific changes:

• File: packages/core/src/rpc/serializeError/index.ts

  • Around lines 30–35 (the newError function), replace:

    const factory = errorFactories.get(name)
    if (factory) {
      return factory()
    }

    with:

    const factory = errorFactories.get(name)
    if (typeof factory === 'function') {
      return factory()
    }

This keeps functionality intact for valid factory functions while hardening against misconfigurations and satisfying the static analyzer.

---

In general, to fix unvalidated dynamic method/constructor calls, we should not blindly invoke the result of a dynamic lookup when the lookup key is tainted. Instead, we should validate that the resolved value is of the expected type (here, a constructible function) and fall back to a safe default if it is not. When the dynamic lookup comes from a controlled registry such as a Map, this amounts to type‑checking the value from the map before using it.

For this specific case, the best fix is to make newError resilient to unexpected entries in errorConstructors. We keep the current fallback behavior (use Error when the name is not in the map, and a special case for AggregateError), but we additionally verify that ErrorConstructor is actually a function that can be used with new. If it is missing or invalid, we safely fall back to the built‑in Error rather than calling new ErrorConstructor() and risking a runtime exception. This change should be done in packages/core/src/rpc/serializeError/index.ts, around lines 30–39 where newError is defined. No new imports are needed: the fix uses existing language features (typeof checks) and existing constructors (Error, AggregateError).

Concretely:

• Replace the simple assignment const ErrorConstructor = errorConstructors.get(name) ?? Error with logic that:
  • Retrieves the candidate from the map.
  • Checks that typeof candidate === 'function'.
  • Falls back to Error if not.
• Leave the AggregateError special case intact, so that behavior for that particular error type is unchanged.
• Then call new ErrorConstructor() as before, but now ErrorConstructor is guaranteed to be a function, making the dynamic call validated and safe.