[webkit-changes] [WebKit/WebKit] 5b7e8d: ASSERTION FAILED: !m_messageReceiverMapCount in IP...

[aestes]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 5b7e8de571abe57c953f584592ba4ea752156e27
      https://github.com/WebKit/WebKit/commit/5b7e8de571abe57c953f584592ba4ea752156e27
  Author: Andy Estes <aestes at apple.com>
  Date:   2023-08-16 (Wed, 16 Aug 2023)

  Changed paths:
    M Source/WebKit/GPUProcess/media/RemoteMediaSourceProxy.cpp
    M Source/WebKit/GPUProcess/media/RemoteMediaSourceProxy.h
    M Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp
    M Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.h

  Log Message:
  -----------
  ASSERTION FAILED: !m_messageReceiverMapCount in IPC::MessageReceiver::~MessageReceiver() when running media layout tests
https://bugs.webkit.org/show_bug.cgi?id=260244
rdar://108192298

Reviewed by Jean-Yves Avenard.

GPUConnectionToWebProcess's connection closing results in RemoteMediaSourceProxy::shutdown() being
called, which sends the MediaSourcePrivateRemote::MediaSourcePrivateShuttingDown message with an
async reply. Since the connection is being closed this message is not sent successfully, but its
async reply handler keeps the RemoteMediaSourceProxy alive. When the handler is later invoked upon
message cancellation the GPUConnectionToWebProcess has been destroyed, so RemoteMediaSourceProxy is
unable to remove itself from the GPUConnectionToWebProcess::messageReceiverMap(). This leaves the
RemoteMediaSourceProxy with a non-zero m_messageReceiverMapCount, leading to the assertion mentioned
above.

Fixed this by ensuring RemoteMediaSourceProxy and its RemoteSourceBufferProxys explicitly remove
themselves from the message receiver map before the GPUConnectionToWebProcess is deallocated.

Fixes flaky crashes in existing media layout tests.

* Source/WebKit/GPUProcess/media/RemoteMediaSourceProxy.cpp:
(WebKit::RemoteMediaSourceProxy::disconnect):
(WebKit::RemoteMediaSourceProxy::~RemoteMediaSourceProxy):
(WebKit::RemoteMediaSourceProxy::shutdown):
* Source/WebKit/GPUProcess/media/RemoteMediaSourceProxy.h:
* Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp:
(WebKit::RemoteSourceBufferProxy::~RemoteSourceBufferProxy):
(WebKit::RemoteSourceBufferProxy::disconnect):
* Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.h:

Canonical link: https://commits.webkit.org/266975@main