Changeset 287775 in webkit

Timestamp:

Jan 7, 2022, 11:57:05 AM (5 years ago)

Author:

mmaxfield@apple.com

Message:

Web process shouldn't crash if ImageBuffer::ensureBackendCreated() fails
​https://bugs.webkit.org/show_bug.cgi?id=232520
<rdar://problem/84829717>

Reviewed by Simon Fraser.

Guard against the possibility of it returning null.

No new tests because there shouldn't be any behavior change after ​https://bugs.webkit.org/show_bug.cgi?id=232470.
It's still good to do this, though, to be defensive.

• Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:

(WebKit::RemoteLayerBackingStore::encode const):

• WebProcess/GPU/graphics/RemoteImageBufferProxy.h:

(WebKit::RemoteImageBufferProxy::createImageBufferBackendHandle):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/RemoteLayerTree/RemoteLayerBackingStore.mm (modified) (2 diffs)
• WebProcess/GPU/graphics/RemoteImageBufferProxy.h (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-10-30  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Web process shouldn't crash if ImageBuffer::ensureBackendCreated() fails
+        https://bugs.webkit.org/show_bug.cgi?id=232520
+        <rdar://problem/84829717>
+
+        Reviewed by Simon Fraser.
+
+        Guard against the possibility of it returning null.
+
+        No new tests because there shouldn't be any behavior change after https://bugs.webkit.org/show_bug.cgi?id=232470.
+        It's still good to do this, though, to be defensive.
+
+        * Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
+        (WebKit::RemoteLayerBackingStore::encode const):
+        * WebProcess/GPU/graphics/RemoteImageBufferProxy.h:
+        (WebKit::RemoteImageBufferProxy::createImageBufferBackendHandle):
+
 2022-01-07  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm

@@ -123 +123 @@
         switch (m_type) {
         case Type::IOSurface:
-            if (m_frontBuffer.imageBuffer->canMapBackingStore())
-                handle = static_cast<AcceleratedImageBufferShareableMappedBackend&>(*m_frontBuffer.imageBuffer->ensureBackendCreated()).createImageBufferBackendHandle();
-            else
-                handle = static_cast<AcceleratedImageBufferShareableBackend&>(*m_frontBuffer.imageBuffer->ensureBackendCreated()).createImageBufferBackendHandle();
+            if (auto* backend = m_frontBuffer.imageBuffer->ensureBackendCreated()) {
+                if (m_frontBuffer.imageBuffer->canMapBackingStore())
+                    handle = static_cast<AcceleratedImageBufferShareableMappedBackend&>(*backend).createImageBufferBackendHandle();
+                else
+                    handle = static_cast<AcceleratedImageBufferShareableBackend&>(*backend).createImageBufferBackendHandle();
+            }
             break;
         case Type::Bitmap:
-            handle = static_cast<UnacceleratedImageBufferShareableBackend&>(*m_frontBuffer.imageBuffer->ensureBackendCreated()).createImageBufferBackendHandle();
+            if (auto* backend = m_frontBuffer.imageBuffer->ensureBackendCreated())
+                handle = static_cast<UnacceleratedImageBufferShareableBackend&>(*backend).createImageBufferBackendHandle();
             break;
         }
@@ -138 +141 @@
 #if ENABLE(CG_DISPLAY_LIST_BACKED_IMAGE_BUFFER)
     std::optional<ImageBufferBackendHandle> displayListHandle;
-    if (m_frontBuffer.displayListImageBuffer)
-        displayListHandle = static_cast<CGDisplayListImageBufferBackend&>(*m_frontBuffer.displayListImageBuffer->ensureBackendCreated()).createImageBufferBackendHandle();
+    if (m_frontBuffer.displayListImageBuffer) {
+        if (auto* backend = m_frontBuffer.displayListImageBuffer->ensureBackendCreated())
+            displayListHandle = static_cast<CGDisplayListImageBufferBackend&>(*backend).createImageBufferBackendHandle();
+    }
 
     encoder << displayListHandle;

trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h

@@ -76 +76 @@
     ImageBufferBackendHandle createImageBufferBackendHandle()
     {
-        ensureBackendCreated();
-        return m_backend->createImageBufferBackendHandle();
+        if (ensureBackendCreated())
+            return m_backend->createImageBufferBackendHandle();
+        return { };
     }