Changeset 276363 in webkit

Timestamp:

Apr 21, 2021, 8:41:57 AM (4 years ago)

Author:

commit-queue@webkit.org

Message:

WebGL GPUP crashes when preparing for display due to off-thread WeakPtr access (IOSURFACE_SET_OWNERSHIP_IDENTITY)
​https://bugs.webkit.org/show_bug.cgi?id=224864

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-04-21
Reviewed by Chris Dumez.

Do not navigate WeakPtr in RemoteGraphicsContextGL thread.
Instead, cache the ownership identity tag during constructor
in main thread.

No new tests, caught with existing tests when the define
is enabled.

• GPUProcess/graphics/RemoteGraphicsContextGLCocoa.cpp:

(WebKit::RemoteGraphicsContextGLCocoa::RemoteGraphicsContextGLCocoa):
(WebKit::RemoteGraphicsContextGLCocoa::prepareForDisplay):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• GPUProcess/graphics/RemoteGraphicsContextGLCocoa.cpp (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-04-21  Kimmo Kinnunen  <kkinnunen@apple.com>
+
+        WebGL GPUP crashes when preparing for display due to off-thread WeakPtr access (IOSURFACE_SET_OWNERSHIP_IDENTITY)
+        https://bugs.webkit.org/show_bug.cgi?id=224864
+
+        Reviewed by Chris Dumez.
+
+        Do not navigate WeakPtr in RemoteGraphicsContextGL thread.
+        Instead, cache the ownership identity tag during constructor
+        in main thread.
+
+        No new tests, caught with existing tests when the define
+        is enabled.
+
+        * GPUProcess/graphics/RemoteGraphicsContextGLCocoa.cpp:
+        (WebKit::RemoteGraphicsContextGLCocoa::RemoteGraphicsContextGLCocoa):
+        (WebKit::RemoteGraphicsContextGLCocoa::prepareForDisplay):
+
 2021-04-21  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLCocoa.cpp

@@ -48 +48 @@
 private:
     WebCore::GraphicsContextGLIOSurfaceSwapChain m_swapChain;
+#if HAVE(TASK_IDENTITY_TOKEN)
+    task_id_token_t m_webProcessIdentityToken;
+#endif
 };
 
@@ -61 +64 @@
 RemoteGraphicsContextGLCocoa::RemoteGraphicsContextGLCocoa(GPUConnectionToWebProcess& gpuConnectionToWebProcess, GraphicsContextGLIdentifier graphicsContextGLIdentifier, RemoteRenderingBackend& renderingBackend, IPC::StreamConnectionBuffer&& stream)
     : RemoteGraphicsContextGL(gpuConnectionToWebProcess, graphicsContextGLIdentifier, renderingBackend, WTFMove(stream))
+#if HAVE(IOSURFACE_SET_OWNERSHIP_IDENTITY)
+    , m_webProcessIdentityToken(gpuConnectionToWebProcess.webProcessIdentityToken())
+#endif
 {
+
 }
 
@@ -76 +83 @@
 #if HAVE(IOSURFACE_SET_OWNERSHIP_IDENTITY)
         // Mark the IOSurface as being owned by the WebProcess even though it was constructed by the GPUProcess so that Jetsam knows which process to kill.
-        if (m_gpuConnectionToWebProcess)
-            surface->setOwnershipIdentity(m_gpuConnectionToWebProcess->webProcessIdentityToken());
+        surface->setOwnershipIdentity(m_webProcessIdentityToken);
 #endif
         sendRight = surface->createSendRight();