Bug 124643 - Remote Layer Tree: 100% repro crasher on the IPC thread when creating lots of layers
Summary: Remote Layer Tree: 100% repro crasher on the IPC thread when creating lots of...
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Tim Horton
Keywords: InRadar
Depends on:
Reported: 2013-11-20 00:42 PST by Tim Horton
Modified: 2013-11-20 13:42 PST (History)
4 users (show)

See Also:

#1 patch (2.22 KB, patch)
2013-11-20 00:54 PST, Tim Horton
no flags Details | Formatted Diff | Diff
#2 patch (2.39 KB, patch)
2013-11-20 00:59 PST, Tim Horton
andersca: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Horton 2013-11-20 00:42:02 PST
CoreIPC::Connection::sendOutgoingMessage crashes after memory has been smashed when creating lots of RemoteLayerTree layers. This occurs because we use mach ports to share the IOSurface backing store, and sendOutgoingMessage always sends the ports in-line, even if they won't fit in the fixed-size 4KB buffer.

We have a few options:

1. Simply mmap a buffer of the requisite size.
2. Do #1 but keep the stack-allocated buffer for performance if the message is under 4KB after out-of-lining the body, swapping to mmap if needed.
3. Figure out how to out-of-line the ports using mach_msg_ool_ports_descriptor_t and co. (I have this partially implemented, but there are some hitches).

Attaching patch for #1 (the simplest option), will adjust as people recommend.

Comment 1 Tim Horton 2013-11-20 00:54:08 PST
Created attachment 217400 [details]
#1 patch
Comment 2 Tim Horton 2013-11-20 00:59:27 PST
Created attachment 217401 [details]
#2 patch
Comment 3 Tim Horton 2013-11-20 01:32:53 PST
Giving up on #3 for now, it's way, way more complicated and I don't want to waste too much time if one of these will do.
Comment 4 Tim Horton 2013-11-20 13:42:50 PST
#2 it is! http://trac.webkit.org/changeset/159582