[webkit-changes] [WebKit/WebKit] 4c3bea: GPU Process occasionally crashes under `StreamServ...

[Wenson Hsieh]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 4c3bead7a9f002198e90175dc520d8d53c4e1a16
      https://github.com/WebKit/WebKit/commit/4c3bead7a9f002198e90175dc520d8d53c4e1a16
  Author: Wenson Hsieh <wenson_hsieh at apple.com>
  Date:   2023-07-20 (Thu, 20 Jul 2023)

  Changed paths:
    M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp
    M Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp
    M Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.h
    M Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLCocoa.cpp
    M Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLWC.cpp
    M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
    M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
    M Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.cpp
    M Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.h
    M Source/WebKit/Platform/IPC/StreamServerConnection.cpp
    M Source/WebKit/Platform/IPC/StreamServerConnection.h
    M Source/WebKit/Shared/IPCStreamTester.cpp
    M Tools/TestWebKitAPI/Tests/IPC/StreamConnectionTests.cpp

  Log Message:
  -----------
  GPU Process occasionally crashes under `StreamServerConnection::create()`
https://bugs.webkit.org/show_bug.cgi?id=259365
rdar://111173638

Reviewed by Tim Horton.

Currently, it's possible for the web process to trigger a release assertion in the GPU process by
attempting to establish stream server connections with stream buffers that are much larger than the
hard-coded 2 MB default, but not so large that it triggers IPC decoding failures. In that scenario,
we crash underneath `StreamServerConnection::create` due to failing to map shared memory for the
stream buffer.

Rather than terminate the GPU process, this patch refactors some logic around stream buffer server
setup so that we instead perform a `MESSAGE_CHECK` on the web process in this case.

See below for more details.

* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:
(WebKit::GPUConnectionToWebProcess::createRenderingBackend):
(WebKit::GPUConnectionToWebProcess::createGraphicsContextGL):
(WebKit::GPUConnectionToWebProcess::createRemoteGPU):

Adjust these GPU process setup helpers so that we first attempt to create a `StreamServerConnection`
which we then pass into the `create()` methods below. In the case where the server connection could
not be made (due to failing to map shared memory), we'll perform a `MESSAGE_CHECK` and bail.

* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:
(WebKit::RemoteGraphicsContextGL::create):

Make these helpers accept a `Ref<StreamServerConnection>` rather than a handle.

(WebKit::RemoteGraphicsContextGL::RemoteGraphicsContextGL):
* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.h:
* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLCocoa.cpp:
(WebKit::RemoteGraphicsContextGL::create):
(WebKit::RemoteGraphicsContextGLCocoa::RemoteGraphicsContextGLCocoa):
* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLWC.cpp:
(WebKit::RemoteGraphicsContextGL::create):
(WebKit::RemoteGraphicsContextGLWC::RemoteGraphicsContextGLWC):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::create):
(WebKit::RemoteRenderingBackend::RemoteRenderingBackend):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h:
* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.cpp:
(WebKit::RemoteGPU::RemoteGPU):
* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.h:
* Source/WebKit/Platform/IPC/StreamServerConnection.cpp:
(IPC::StreamServerConnection::tryCreate):

Change this from `create()` to `tryCreate()`, and make it return a `RefPtr` instead of a `Ref` in
the case where we fail to map the shared memory.

(IPC::StreamServerConnection::create): Deleted.
* Source/WebKit/Platform/IPC/StreamServerConnection.h:
* Source/WebKit/Shared/IPCStreamTester.cpp:
(WebKit::IPCStreamTester::IPCStreamTester):
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::ensureGPUProcessConnection):
* Tools/TestWebKitAPI/Tests/IPC/StreamConnectionTests.cpp:

Canonical link: https://commits.webkit.org/266196@main