Title: [280694] branches/safari-612.1.27.0-branch/Source/WebKit
- Revision
- 280694
- Author
- [email protected]
- Date
- 2021-08-05 09:26:55 -0700 (Thu, 05 Aug 2021)
Log Message
Cherry-pick r280639. rdar://problem/81568951
[GPU Process] REGRESSION: iCloud Photos Web app may crash WebProcess once the GPUProcess is relaunched
https://bugs.webkit.org/show_bug.cgi?id=228665
Reviewed by Simon Fraser.
When the GPUProcess is relaunched, ensure NativeImage is detached from
the RemoteResourceCacheProxy once it is removed from its m_nativeImages.
Otherwise the NativeImage later will ask RemoteResourceCacheProxy to
release its corresponding NativeImage from RemoteResourceCache even
though it was destroyed when the GPUProcess was relaunched.
* WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:
(WebKit::RemoteResourceCacheProxy::~RemoteResourceCacheProxy):
(WebKit::RemoteResourceCacheProxy::clearNativeImageMap):
(WebKit::RemoteResourceCacheProxy::remoteResourceCacheWasDestroyed):
* WebProcess/GPU/graphics/RemoteResourceCacheProxy.h:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@280639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-612.1.27.0-branch/Source/WebKit/ChangeLog (280693 => 280694)
--- branches/safari-612.1.27.0-branch/Source/WebKit/ChangeLog 2021-08-05 16:26:53 UTC (rev 280693)
+++ branches/safari-612.1.27.0-branch/Source/WebKit/ChangeLog 2021-08-05 16:26:55 UTC (rev 280694)
@@ -1,5 +1,50 @@
2021-08-05 Russell Epstein <[email protected]>
+ Cherry-pick r280639. rdar://problem/81568951
+
+ [GPU Process] REGRESSION: iCloud Photos Web app may crash WebProcess once the GPUProcess is relaunched
+ https://bugs.webkit.org/show_bug.cgi?id=228665
+
+ Reviewed by Simon Fraser.
+
+ When the GPUProcess is relaunched, ensure NativeImage is detached from
+ the RemoteResourceCacheProxy once it is removed from its m_nativeImages.
+
+ Otherwise the NativeImage later will ask RemoteResourceCacheProxy to
+ release its corresponding NativeImage from RemoteResourceCache even
+ though it was destroyed when the GPUProcess was relaunched.
+
+ * WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:
+ (WebKit::RemoteResourceCacheProxy::~RemoteResourceCacheProxy):
+ (WebKit::RemoteResourceCacheProxy::clearNativeImageMap):
+ (WebKit::RemoteResourceCacheProxy::remoteResourceCacheWasDestroyed):
+ * WebProcess/GPU/graphics/RemoteResourceCacheProxy.h:
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@280639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-08-04 Said Abou-Hallawa <[email protected]>
+
+ [GPU Process] REGRESSION: iCloud Photos Web app may crash WebProcess once the GPUProcess is relaunched
+ https://bugs.webkit.org/show_bug.cgi?id=228665
+
+ Reviewed by Simon Fraser.
+
+ When the GPUProcess is relaunched, ensure NativeImage is detached from
+ the RemoteResourceCacheProxy once it is removed from its m_nativeImages.
+
+ Otherwise the NativeImage later will ask RemoteResourceCacheProxy to
+ release its corresponding NativeImage from RemoteResourceCache even
+ though it was destroyed when the GPUProcess was relaunched.
+
+ * WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:
+ (WebKit::RemoteResourceCacheProxy::~RemoteResourceCacheProxy):
+ (WebKit::RemoteResourceCacheProxy::clearNativeImageMap):
+ (WebKit::RemoteResourceCacheProxy::remoteResourceCacheWasDestroyed):
+ * WebProcess/GPU/graphics/RemoteResourceCacheProxy.h:
+
+2021-08-05 Russell Epstein <[email protected]>
+
Cherry-pick r280606. rdar://problem/81475582
[iOS] Fix sandbox violation in GPU process
Modified: branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp (280693 => 280694)
--- branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp 2021-08-05 16:26:53 UTC (rev 280693)
+++ branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp 2021-08-05 16:26:55 UTC (rev 280694)
@@ -41,8 +41,7 @@
RemoteResourceCacheProxy::~RemoteResourceCacheProxy()
{
- for (auto& nativeImageState : m_nativeImages.values())
- nativeImageState.image->removeObserver(*this);
+ clearNativeImageMap();
}
void RemoteResourceCacheProxy::cacheImageBuffer(WebCore::ImageBuffer& imageBuffer)
@@ -153,6 +152,13 @@
m_remoteRenderingBackendProxy.releaseRemoteResource(renderingResourceIdentifier, useCount);
}
+void RemoteResourceCacheProxy::clearNativeImageMap()
+{
+ for (auto& nativeImageState : m_nativeImages.values())
+ nativeImageState.image->removeObserver(*this);
+ m_nativeImages.clear();
+}
+
void RemoteResourceCacheProxy::prepareForNextRenderingUpdate()
{
m_numberOfFontsUsedInCurrentRenderingUpdate = 0;
@@ -204,7 +210,7 @@
item.useCount = 0;
item.imageBuffer->clearBackend();
}
- m_nativeImages.clear();
+ clearNativeImageMap();
clearFontMap();
}
Modified: branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.h (280693 => 280694)
--- branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.h 2021-08-05 16:26:53 UTC (rev 280693)
+++ branches/safari-612.1.27.0-branch/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.h 2021-08-05 16:26:55 UTC (rev 280694)
@@ -79,6 +79,8 @@
using FontHashMap = HashMap<WebCore::RenderingResourceIdentifier, FontState>;
void releaseNativeImage(WebCore::RenderingResourceIdentifier) override;
+ void clearNativeImageMap();
+
void finalizeRenderingUpdateForFonts();
void prepareForNextRenderingUpdate();
void clearFontMap();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
