Bug 242142 - [GPU Process] RemoteRenderingBackend must ignore resource messages once m_remoteResourceCache is cleared
Summary: [GPU Process] RemoteRenderingBackend must ignore resource messages once m_rem...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Said Abou-Hallawa
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-06-29 15:24 PDT by Said Abou-Hallawa
Modified: 2022-07-06 13:19 PDT (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Said Abou-Hallawa 2022-06-29 15:24:29 PDT
RemoteRenderingBackend::stopListeningForIPC() is calling StreamServerConnection::stopReceivingMessages() after it dispatch a code block code which clear its m_remoteResourceCache. But this can allow incoming messages to be dispatched to RemoteRenderingBackend including the message RemoteRenderingBackend::ReleaseRemoteResource. If this message is received after clearing m_remoteResourceCache, GPUProcess will simulate-crash with the message "Resource is being released before being cached."

To fix this, we need to call StreamServerConnection::stopReceivingMessages() before clearing the resource cache. Once this call is returned, no incoming stream connection messages can be dispatched to RemoteRenderingBackend. RemoteRenderingBackend::m_workQueue will remove RemoteRenderingBackend::m_streamConnection as its connection. And RemoteRenderingBackend::m_streamConnection will remove the RemoteRenderingBackend as its message receiver. So StreamConnectionWorkQueue::processStreams() won't process the messages of RemoteRenderingBackend::m_streamConnection.

After we call StreamServerConnection::stopReceivingMessages(), we can dispatch the code block which clears m_remoteResourceCache. This code has be executed on the stream connection WorkQueue. The WorkQueue should be still running after calling StreamServerConnection::stopReceivingMessages(). It will be executed by StreamConnectionWorkQueue::processStreams() when processing m_functions.

After dispatching the code block which clears m_remoteResourceCache, we need to call StreamConnectionWorkQueue::stopAndWaitForCompletion() to ensure the code block is executed and the WorkQueue has been stopped.
Comment 1 Said Abou-Hallawa 2022-06-29 15:24:51 PDT
rdar://94143906
Comment 2 Said Abou-Hallawa 2022-06-29 15:30:44 PDT
Pull request: https://github.com/WebKit/WebKit/pull/1919
Comment 3 EWS 2022-07-06 13:19:54 PDT
Committed 252187@main (682daa785509): <https://commits.webkit.org/252187@main>

Reviewed commits have been landed. Closing PR #1919 and removing active labels.