Changeset 280694 in webkit

Timestamp:

Aug 5, 2021, 9:26:55 AM (5 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r280639. rdar://problem/81568951

[GPU Process] REGRESSION: iCloud Photos Web app may crash WebProcess once the GPUProcess is relaunched
​https://bugs.webkit.org/show_bug.cgi?id=228665

Reviewed by Simon Fraser.

When the GPUProcess is relaunched, ensure NativeImage is detached from
the RemoteResourceCacheProxy once it is removed from its m_nativeImages.

Otherwise the NativeImage later will ask RemoteResourceCacheProxy to
release its corresponding NativeImage from RemoteResourceCache even
though it was destroyed when the GPUProcess was relaunched.

• WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp: (WebKit::RemoteResourceCacheProxy::~RemoteResourceCacheProxy): (WebKit::RemoteResourceCacheProxy::clearNativeImageMap): (WebKit::RemoteResourceCacheProxy::remoteResourceCacheWasDestroyed):
• WebProcess/GPU/graphics/RemoteResourceCacheProxy.h:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280639 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612.1.27.0-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp (modified) (3 diffs)
• WebProcess/GPU/graphics/RemoteResourceCacheProxy.h (modified) (1 diff)

branches/safari-612.1.27.0-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2021-08-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r280639. rdar://problem/81568951
+
+    [GPU Process] REGRESSION: iCloud Photos Web app may crash WebProcess once the GPUProcess is relaunched
+    https://bugs.webkit.org/show_bug.cgi?id=228665
+    
+    Reviewed by Simon Fraser.
+    
+    When the GPUProcess is relaunched, ensure NativeImage is detached from
+    the RemoteResourceCacheProxy once it is removed from its m_nativeImages.
+    
+    Otherwise the NativeImage later will ask RemoteResourceCacheProxy to
+    release its corresponding NativeImage from RemoteResourceCache even
+    though it was destroyed when the GPUProcess was relaunched.
+    
+    * WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:
+    (WebKit::RemoteResourceCacheProxy::~RemoteResourceCacheProxy):
+    (WebKit::RemoteResourceCacheProxy::clearNativeImageMap):
+    (WebKit::RemoteResourceCacheProxy::remoteResourceCacheWasDestroyed):
+    * WebProcess/GPU/graphics/RemoteResourceCacheProxy.h:
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@280639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-08-04  Said Abou-Hallawa  <said@apple.com>
+
+            [GPU Process] REGRESSION: iCloud Photos Web app may crash WebProcess once the GPUProcess is relaunched
+            https://bugs.webkit.org/show_bug.cgi?id=228665
+
+            Reviewed by Simon Fraser.
+
+            When the GPUProcess is relaunched, ensure NativeImage is detached from
+            the RemoteResourceCacheProxy once it is removed from its m_nativeImages.
+
+            Otherwise the NativeImage later will ask RemoteResourceCacheProxy to
+            release its corresponding NativeImage from RemoteResourceCache even
+            though it was destroyed when the GPUProcess was relaunched.
+
+            * WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:
+            (WebKit::RemoteResourceCacheProxy::~RemoteResourceCacheProxy):
+            (WebKit::RemoteResourceCacheProxy::clearNativeImageMap):
+            (WebKit::RemoteResourceCacheProxy::remoteResourceCacheWasDestroyed):
+            * WebProcess/GPU/graphics/RemoteResourceCacheProxy.h:
+
 2021-08-05  Russell Epstein  <repstein@apple.com>
 

branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp

@@ -42 +42 @@
 RemoteResourceCacheProxy::~RemoteResourceCacheProxy()
 {
-    for (auto& nativeImageState : m_nativeImages.values())
-        nativeImageState.image->removeObserver(*this);
+    clearNativeImageMap();
 }
 
@@ -152 +151 @@
 
     m_remoteRenderingBackendProxy.releaseRemoteResource(renderingResourceIdentifier, useCount);
+}
+
+void RemoteResourceCacheProxy::clearNativeImageMap()
+{
+    for (auto& nativeImageState : m_nativeImages.values())
+        nativeImageState.image->removeObserver(*this);
+    m_nativeImages.clear();
 }
 
@@ -205 +211 @@
         item.imageBuffer->clearBackend();
     }
-    m_nativeImages.clear();
+    clearNativeImageMap();
     clearFontMap();
 }

branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.h

@@ -80 +80 @@
     
     void releaseNativeImage(WebCore::RenderingResourceIdentifier) override;
+    void clearNativeImageMap();
+
     void finalizeRenderingUpdateForFonts();
     void prepareForNextRenderingUpdate();