Bug 242142

Summary: [GPU Process] RemoteRenderingBackend must ignore resource messages once m_remoteResourceCache is cleared
Product: WebKit Reporter: Said Abou-Hallawa <sabouhallawa>
Component: Layout and RenderingAssignee: Said Abou-Hallawa <sabouhallawa>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Said Abou-Hallawa 2022-06-29 15:24:29 PDT
RemoteRenderingBackend::stopListeningForIPC() is calling StreamServerConnection::stopReceivingMessages() after it dispatch a code block code which clear its m_remoteResourceCache. But this can allow incoming messages to be dispatched to RemoteRenderingBackend including the message RemoteRenderingBackend::ReleaseRemoteResource. If this message is received after clearing m_remoteResourceCache, GPUProcess will simulate-crash with the message "Resource is being released before being cached."

To fix this, we need to call StreamServerConnection::stopReceivingMessages() before clearing the resource cache. Once this call is returned, no incoming stream connection messages can be dispatched to RemoteRenderingBackend. RemoteRenderingBackend::m_workQueue will remove RemoteRenderingBackend::m_streamConnection as its connection. And RemoteRenderingBackend::m_streamConnection will remove the RemoteRenderingBackend as its message receiver. So StreamConnectionWorkQueue::processStreams() won't process the messages of RemoteRenderingBackend::m_streamConnection.

After we call StreamServerConnection::stopReceivingMessages(), we can dispatch the code block which clears m_remoteResourceCache. This code has be executed on the stream connection WorkQueue. The WorkQueue should be still running after calling StreamServerConnection::stopReceivingMessages(). It will be executed by StreamConnectionWorkQueue::processStreams() when processing m_functions.

After dispatching the code block which clears m_remoteResourceCache, we need to call StreamConnectionWorkQueue::stopAndWaitForCompletion() to ensure the code block is executed and the WorkQueue has been stopped.
Comment 1 Said Abou-Hallawa 2022-06-29 15:24:51 PDT
rdar://94143906
Comment 2 Said Abou-Hallawa 2022-06-29 15:30:44 PDT
Pull request: https://github.com/WebKit/WebKit/pull/1919
Comment 3 EWS 2022-07-06 13:19:54 PDT
Committed 252187@main (682daa785509): <https://commits.webkit.org/252187@main>

Reviewed commits have been landed. Closing PR #1919 and removing active labels.