Bug 229106

Summary: [GPU Process] REGRESSION: WebContent often crashes when opening a Google spreadsheet with charts
Product: WebKit Reporter: Said Abou-Hallawa <sabouhallawa>
Component: CanvasAssignee: Said Abou-Hallawa <sabouhallawa>
Status: RESOLVED FIXED    
Severity: Normal CC: dino, simon.fraser, thorton, webkit-bug-importer, wenson_hsieh
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
ews-feeder: commit-queue-
Patch
none
Patch
none
Safer but less reliable fix none

Said Abou-Hallawa
Reported 2021-08-14 01:41:37 PDT
The crash may happen when creating many ImageBuffers consecutively. So WebProcess sends many RemoteRenderingBackend::CreateImageBuffer messages to WebProcess. While the GPUProcess is busy creating the backends and sending the messages RemoteRenderingBackendProxy::DidCreateImageBufferBackend back to WebProcess, the WebProcess is busy drawing to the new ImageBuffers by appending DisplayList items to their DrawingContexts. RemoteRenderingBackendProxy::didAppendData() is called back with every DisplayList item appended to any ImageBuffer DisplayList. The problem happens when appending DisplayList item to a backend-less RemoteImageBufferProxy. Here is an example which may cause this crash: WebProcess: 1. RemoteRenderingBackend::CreateImageBuffer is sent for RemoteImageBufferProxy 'A'. 2. RemoteRenderingBackend::DidCreateImageBufferBackend is received for RemoteImageBufferProxy 'A'. 3. DisplayList items are appended to the context of a RemoteImageBufferProxy 'A'. 4. RemoteRenderingBackend::CreateImageBuffer is sent for RemoteImageBufferProxy 'B'. 5. DisplayList items are appended to the context of a backend-less RemoteImageBufferProxy 'B'. 6. RemoteRenderingBackendProxy::didAppendData() sends RemoteRenderingBackend::WakeUpAndApplyDisplayList message = { 'A', GPUProcessWakeupReason::ItemCountHysteresisExceeded, ... } 7. RemoteRenderingBackend::CreateImageBuffer is sent for RemoteImageBufferProxy 'C'. 8. DisplayList items are appended to the context of a backend-less RemoteImageBufferProxy 'C'. 9. m_parameters.resumeDisplayListSemaphore is signaled with resumeReadingInfo { 'C', ... } GPUProcess: 1. RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists() replays the DisplayList items to the backend of 'A' 2. RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists() sets m_pendingWakeupInfo to { 'B', GPUProcessWakeupReason::ItemCountHysteresisExceeded } 3. RemoteRenderingBackend::createImageBuffer() is called to create the RemoteImageBuffer 'B'. 4. RemoteRenderingBackend::createImageBuffer() voluntarily calls wakeUpAndApplyDisplayList() because m_pendingWakeupInfo matches 'B' 5. RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists() replays the DisplayList items to the backend of 'B' 6. Trying to find the next ImageBuffer, nextDestinationImageBufferAfterApplyingDisplayLists sees the reason = GPUProcessWakeupReason::ItemCountHysteresisExceeded so it looks at the resumeReadingInfo 7. It finds the resumeReadingInfo->destination = 'C' but it does not find in its cache because it has not been created yet. Here is the call stack: Requesting termination of web process 23 for reason: "Missing image buffer destination when resuming display list processing" Thread 2 Crashed:: WebKit::RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists(WebCore::ImageBuffer&, unsigned long, WebKit::DisplayListReaderHandle&, WebKit::GPUProcessWakeupReason) + 2364 WebKit::RemoteRenderingBackend::wakeUpAndApplyDisplayList(WebKit::GPUProcessWakeupMessageArguments const&) + 180 WebKit::RemoteRenderingBackend::createImageBuffer(WebCore::FloatSize const&, WebCore::RenderingMode, float, WebCore::DestinationColorSpace const&, WebCore::PixelFormat, WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>) + 1352 WebKit::RemoteRenderingBackend::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 2044 WTF::dispatchWorkItem<WTF::(anonymous namespace)::DispatchWorkItem>(void*) + 60
Attachments
Patch (1.83 KB, patch)
2021-08-14 01:57 PDT, Said Abou-Hallawa
ews-feeder: commit-queue-
Patch (5.10 KB, patch)
2021-08-14 04:00 PDT, Said Abou-Hallawa
no flags
Patch (5.06 KB, patch)
2021-08-14 05:28 PDT, Said Abou-Hallawa
no flags
Safer but less reliable fix (2.16 KB, patch)
2021-08-14 13:39 PDT, Said Abou-Hallawa
no flags
Said Abou-Hallawa
Comment 1 2021-08-14 01:42:08 PDT
Said Abou-Hallawa
Comment 2 2021-08-14 01:57:49 PDT
Said Abou-Hallawa
Comment 3 2021-08-14 04:00:08 PDT
Said Abou-Hallawa
Comment 4 2021-08-14 05:28:27 PDT
Said Abou-Hallawa
Comment 5 2021-08-14 13:39:47 PDT
Created attachment 435549 [details] Safer but less reliable fix
EWS
Comment 6 2021-08-14 16:23:05 PDT
Committed r281058 (240521@main): <https://commits.webkit.org/240521@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 435538 [details].
Note You need to log in before you can comment on or make changes to this bug.