RESOLVED FIXED 124643
Remote Layer Tree: 100% repro crasher on the IPC thread when creating lots of layers 
https://bugs.webkit.org/show_bug.cgi?id=124643
Summary Remote Layer Tree: 100% repro crasher on the IPC thread when creating lots of...
Tim Horton
Reported 2013-11-20 00:42:02 PST
CoreIPC::Connection::sendOutgoingMessage crashes after memory has been smashed when creating lots of RemoteLayerTree layers. This occurs because we use mach ports to share the IOSurface backing store, and sendOutgoingMessage always sends the ports in-line, even if they won't fit in the fixed-size 4KB buffer. We have a few options: 1. Simply mmap a buffer of the requisite size. 2. Do #1 but keep the stack-allocated buffer for performance if the message is under 4KB after out-of-lining the body, swapping to mmap if needed. 3. Figure out how to out-of-line the ports using mach_msg_ool_ports_descriptor_t and co. (I have this partially implemented, but there are some hitches). Attaching patch for #1 (the simplest option), will adjust as people recommend. <rdar://problem/15491080>
Attachments
#1 patch (2.22 KB, patch)
2013-11-20 00:54 PST, Tim Horton 		no flags
DetailsFormatted DiffDiff
#2 patch (2.39 KB, patch)
2013-11-20 00:59 PST, Tim Horton 		andersca: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Tim Horton
Comment 1 2013-11-20 00:54:08 PST
Created attachment 217400 [details] #1 patch
Tim Horton
Comment 2 2013-11-20 00:59:27 PST
Created attachment 217401 [details] #2 patch
Tim Horton
Comment 3 2013-11-20 01:32:53 PST
Giving up on #3 for now, it's way, way more complicated and I don't want to waste too much time if one of these will do.
Tim Horton
Comment 4 2013-11-20 13:42:50 PST
#2 it is! http://trac.webkit.org/changeset/159582
Note You need to log in before you can comment on or make changes to this bug.