Bug 232520 – Web process shouldn't crash if ImageBuffer::ensureBackendCreated() fails

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Myles C. Maxfield]

RemoteLayerBackingStore::encode() assumes it can never fail, but it can. There may be other places, too.

[Radar WebKit Bug Importer]

<rdar://problem/84829995>

[Myles C. Maxfield]

Created attachment 442906 [details]
Patch

[Cameron McCormack (:heycam)]

Comment on attachment 442906 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=442906&action=review

> Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:121
> +                if (auto* backend = m_frontBuffer.imageBuffer->ensureBackendCreated())

Since we do this check in all situations -- mapped IOSurface, non-mapped IOSurface, bitmap -- maybe do it once before the switch.

[Myles C. Maxfield]

Comment on attachment 442906 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=442906&action=review

>> Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:121
>> +                if (auto* backend = m_frontBuffer.imageBuffer->ensureBackendCreated())
> 
> Since we do this check in all situations -- mapped IOSurface, non-mapped IOSurface, bitmap -- maybe do it once before the switch.

The third case below is slightly different, but yes I can hoist it somewhat.

[Myles C. Maxfield]

Committed r285088 (243730@main): <https://commits.webkit.org/243730@main>

[WebKit Commit Bot]

Re-opened since this is blocked by bug 234680

[Myles C. Maxfield]

The A/B test was using bogus data - before crashes were fixed, the memory data was reported from processes which didn't have the test page loaded. So, rolling this out was a mistake. Rolling back in now.

[Myles C. Maxfield]

Committed r287775 (245835@trunk): <https://commits.webkit.org/245835@trunk>