Bug 229106 - [GPU Process] REGRESSION: WebContent often crashes when opening a Google spreadsheet with charts
Summary: [GPU Process] REGRESSION: WebContent often crashes when opening a Google spre...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Canvas (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Said Abou-Hallawa
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-08-14 01:41 PDT by Said Abou-Hallawa
Modified: 2021-08-14 16:23 PDT (History)
5 users (show)

See Also:


Attachments
Patch (1.83 KB, patch)
2021-08-14 01:57 PDT, Said Abou-Hallawa
ews-feeder: commit-queue-
Details | Formatted Diff | Diff
Patch (5.10 KB, patch)
2021-08-14 04:00 PDT, Said Abou-Hallawa
no flags Details | Formatted Diff | Diff
Patch (5.06 KB, patch)
2021-08-14 05:28 PDT, Said Abou-Hallawa
no flags Details | Formatted Diff | Diff
Safer but less reliable fix (2.16 KB, patch)
2021-08-14 13:39 PDT, Said Abou-Hallawa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Said Abou-Hallawa 2021-08-14 01:41:37 PDT
The crash may happen when creating many ImageBuffers consecutively. So WebProcess sends many RemoteRenderingBackend::CreateImageBuffer messages to WebProcess. While the GPUProcess is busy creating the backends and sending the messages RemoteRenderingBackendProxy::DidCreateImageBufferBackend back to WebProcess, the WebProcess is busy drawing to the new ImageBuffers by appending DisplayList items to their DrawingContexts.

RemoteRenderingBackendProxy::didAppendData() is called back with every DisplayList item appended to any ImageBuffer DisplayList. The problem happens when appending DisplayList item to a backend-less RemoteImageBufferProxy. Here is an example which may cause this crash:

WebProcess:

1. RemoteRenderingBackend::CreateImageBuffer is sent for RemoteImageBufferProxy 'A'.
2. RemoteRenderingBackend::DidCreateImageBufferBackend is received for RemoteImageBufferProxy 'A'.
3. DisplayList items are appended to the context of a RemoteImageBufferProxy 'A'.
4. RemoteRenderingBackend::CreateImageBuffer is sent for RemoteImageBufferProxy 'B'.
5. DisplayList items are appended to the context of a backend-less RemoteImageBufferProxy 'B'.
6. RemoteRenderingBackendProxy::didAppendData() sends RemoteRenderingBackend::WakeUpAndApplyDisplayList message = { 'A', GPUProcessWakeupReason::ItemCountHysteresisExceeded, ... }
7. RemoteRenderingBackend::CreateImageBuffer is sent for RemoteImageBufferProxy 'C'.
8. DisplayList items are appended to the context of a backend-less RemoteImageBufferProxy 'C'.
9. m_parameters.resumeDisplayListSemaphore is signaled with resumeReadingInfo { 'C', ... }

GPUProcess:

1. RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists() replays the DisplayList items to the backend of 'A'
2. RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists() sets m_pendingWakeupInfo to { 'B', GPUProcessWakeupReason::ItemCountHysteresisExceeded }
3. RemoteRenderingBackend::createImageBuffer() is called to create the RemoteImageBuffer 'B'.
4. RemoteRenderingBackend::createImageBuffer() voluntarily calls wakeUpAndApplyDisplayList() because m_pendingWakeupInfo matches 'B'
5. RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists() replays the DisplayList items to the backend of 'B'
6. Trying to find the next ImageBuffer, nextDestinationImageBufferAfterApplyingDisplayLists sees the reason = GPUProcessWakeupReason::ItemCountHysteresisExceeded so it looks at the resumeReadingInfo
7. It finds the resumeReadingInfo->destination = 'C' but it does not find in its cache because it has not been created yet.

Here is the call stack:


Requesting termination of web process 23 for reason: "Missing image buffer destination when resuming display list processing"

Thread 2 Crashed::  
WebKit::RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists(WebCore::ImageBuffer&, unsigned long, WebKit::DisplayListReaderHandle&, WebKit::GPUProcessWakeupReason) + 2364
WebKit::RemoteRenderingBackend::wakeUpAndApplyDisplayList(WebKit::GPUProcessWakeupMessageArguments const&) + 180
WebKit::RemoteRenderingBackend::createImageBuffer(WebCore::FloatSize const&, WebCore::RenderingMode, float, WebCore::DestinationColorSpace const&, WebCore::PixelFormat, WTF::ObjectIdentifier<WebCore::RenderingResourceIdentifierType>) + 1352 
WebKit::RemoteRenderingBackend::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 2044
WTF::dispatchWorkItem<WTF::(anonymous namespace)::DispatchWorkItem>(void*) + 60
Comment 1 Said Abou-Hallawa 2021-08-14 01:42:08 PDT
<rdar://81806877>
Comment 2 Said Abou-Hallawa 2021-08-14 01:57:49 PDT
Created attachment 435535 [details]
Patch
Comment 3 Said Abou-Hallawa 2021-08-14 04:00:08 PDT
Created attachment 435536 [details]
Patch
Comment 4 Said Abou-Hallawa 2021-08-14 05:28:27 PDT
Created attachment 435538 [details]
Patch
Comment 5 Said Abou-Hallawa 2021-08-14 13:39:47 PDT
Created attachment 435549 [details]
Safer but less reliable fix
Comment 6 EWS 2021-08-14 16:23:05 PDT
Committed r281058 (240521@main): <https://commits.webkit.org/240521@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 435538 [details].