<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[170179] trunk/Source</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/170179">170179</a></dd>
<dt>Author</dt> <dd>timothy_horton@apple.com</dd>
<dt>Date</dt> <dd>2014-06-20 00:33:58 -0700 (Fri, 20 Jun 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>LayerPool’d PlatformCALayerRemote/RemoteLayerBackingStore can have stale context pointers
https://bugs.webkit.org/show_bug.cgi?id=134050
<rdar://problem/17315114>
Reviewed by Simon Fraser.
* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(WebKit::PlatformCALayerRemote::recursiveBuildTransaction):
(WebKit::PlatformCALayerRemote::layerPool):
* WebProcess/WebPage/mac/PlatformCALayerRemote.h:
* WebProcess/WebPage/mac/RemoteLayerTreeContext.h:
(WebKit::RemoteLayerTreeContext::layerPool):
* WebProcess/WebPage/mac/RemoteLayerTreeContext.mm:
(WebKit::RemoteLayerTreeContext::buildTransaction):
Ensure that layers being committed are always in the context that is committing them.
Use a LayerPool per RemoteLayerTreeContext, to avoid moving layers between contexts.
* WebCore.exp.in:
* WebCore.xcodeproj/project.pbxproj:
* platform/cocoa/MemoryPressureHandlerCocoa.mm:
(WebCore::MemoryPressureHandler::platformReleaseMemory):
Drain all LayerPools upon memory pressure.
* platform/graphics/ca/LayerPool.cpp:
(WebCore::LayerPool::LayerPool):
(WebCore::LayerPool::~LayerPool):
(WebCore::LayerPool::allLayerPools):
(WebCore::LayerPool::sharedPool): Deleted.
* platform/graphics/ca/LayerPool.h:
* platform/graphics/ca/PlatformCALayer.cpp:
(WebCore::PlatformCALayer::createCompatibleLayerWithSize):
Add createCompatibleLayerWithSize, which optionally tries to take said layer from the LayerPool.
(WebCore::PlatformCALayer::moveToLayerPool):
Add moveToLayerPool, which moves the layer to the LayerPool.
(WebCore::PlatformCALayer::layerPool):
The LayerPool for each layer is obtained via PlatformCALayer::layerPool(), which subclasses can override for special behaviors.
The base class uses a global LayerPool.
* platform/graphics/ca/PlatformCALayer.h:
* platform/graphics/ca/TileController.cpp:
(WebCore::TileController::createTileLayer):
* platform/graphics/ca/TileGrid.cpp:
(WebCore::TileGrid::removeTiles):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreWebCoreexpin">trunk/Source/WebCore/WebCore.exp.in</a></li>
<li><a href="#trunkSourceWebCoreWebCorexcodeprojprojectpbxproj">trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceWebCoreplatformcocoaMemoryPressureHandlerCocoamm">trunk/Source/WebCore/platform/cocoa/MemoryPressureHandlerCocoa.mm</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscaLayerPoolcpp">trunk/Source/WebCore/platform/graphics/ca/LayerPool.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscaLayerPoolh">trunk/Source/WebCore/platform/graphics/ca/LayerPool.h</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscaPlatformCALayercpp">trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscaPlatformCALayerh">trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.h</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscaTileControllercpp">trunk/Source/WebCore/platform/graphics/ca/TileController.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscaTileGridcpp">trunk/Source/WebCore/platform/graphics/ca/TileGrid.cpp</a></li>
<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>
<li><a href="#trunkSourceWebKit2WebProcessWebPagemacPlatformCALayerRemotecpp">trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.cpp</a></li>
<li><a href="#trunkSourceWebKit2WebProcessWebPagemacPlatformCALayerRemoteh">trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.h</a></li>
<li><a href="#trunkSourceWebKit2WebProcessWebPagemacRemoteLayerTreeContexth">trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.h</a></li>
<li><a href="#trunkSourceWebKit2WebProcessWebPagemacRemoteLayerTreeContextmm">trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.mm</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/ChangeLog 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -1,3 +1,40 @@
</span><ins>+2014-06-20 Tim Horton <timothy_horton@apple.com>
+
+ LayerPool’d PlatformCALayerRemote/RemoteLayerBackingStore can have stale context pointers
+ https://bugs.webkit.org/show_bug.cgi?id=134050
+ <rdar://problem/17315114>
+
+ Reviewed by Simon Fraser.
+
+ * WebCore.exp.in:
+ * WebCore.xcodeproj/project.pbxproj:
+ * platform/cocoa/MemoryPressureHandlerCocoa.mm:
+ (WebCore::MemoryPressureHandler::platformReleaseMemory):
+ Drain all LayerPools upon memory pressure.
+
+ * platform/graphics/ca/LayerPool.cpp:
+ (WebCore::LayerPool::LayerPool):
+ (WebCore::LayerPool::~LayerPool):
+ (WebCore::LayerPool::allLayerPools):
+ (WebCore::LayerPool::sharedPool): Deleted.
+ * platform/graphics/ca/LayerPool.h:
+ * platform/graphics/ca/PlatformCALayer.cpp:
+ (WebCore::PlatformCALayer::createCompatibleLayerWithSize):
+ Add createCompatibleLayerWithSize, which optionally tries to take said layer from the LayerPool.
+
+ (WebCore::PlatformCALayer::moveToLayerPool):
+ Add moveToLayerPool, which moves the layer to the LayerPool.
+
+ (WebCore::PlatformCALayer::layerPool):
+ The LayerPool for each layer is obtained via PlatformCALayer::layerPool(), which subclasses can override for special behaviors.
+ The base class uses a global LayerPool.
+
+ * platform/graphics/ca/PlatformCALayer.h:
+ * platform/graphics/ca/TileController.cpp:
+ (WebCore::TileController::createTileLayer):
+ * platform/graphics/ca/TileGrid.cpp:
+ (WebCore::TileGrid::removeTiles):
+
</ins><span class="cx"> 2014-06-19 Carlos Garcia Campos <cgarcia@igalia.com>
</span><span class="cx">
</span><span class="cx"> [GTK] webkit_dom_document_create_tree_walker impossible to use due to WebKitDOMNodeFilter
</span></span></pre></div>
<a id="trunkSourceWebCoreWebCoreexpin"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/WebCore.exp.in (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/WebCore.exp.in 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/WebCore.exp.in 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -1468,6 +1468,8 @@
</span><span class="cx"> __ZN7WebCore9InlineBox14selectionStateEv
</span><span class="cx"> __ZN7WebCore9InlineBox16placeEllipsisBoxEbfffRfRb
</span><span class="cx"> __ZN7WebCore9JSElement6s_infoE
</span><ins>+__ZN7WebCore9LayerPoolC1Ev
+__ZN7WebCore9LayerPoolD1Ev
</ins><span class="cx"> __ZN7WebCore9PageCache11setCapacityEi
</span><span class="cx"> __ZN7WebCore9PageCache33markPagesForVistedLinkStyleRecalcEv
</span><span class="cx"> __ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
</span></span></pre></div>
<a id="trunkSourceWebCoreWebCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -1492,8 +1492,8 @@
</span><span class="cx"> 439046DD12DA25E800AF80A2 /* RenderMathMLMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046C912DA25E800AF80A2 /* RenderMathMLMath.cpp */; };
</span><span class="cx"> 439046DE12DA25E800AF80A2 /* RenderMathMLMath.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CA12DA25E800AF80A2 /* RenderMathMLMath.h */; };
</span><span class="cx"> 439046DF12DA25E800AF80A2 /* RenderMathMLOperator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046CB12DA25E800AF80A2 /* RenderMathMLOperator.cpp */; };
</span><ins>+ 439046DF12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046CB12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp */; };
</ins><span class="cx"> 439046E012DA25E800AF80A2 /* RenderMathMLOperator.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CC12DA25E800AF80A2 /* RenderMathMLOperator.h */; };
</span><del>- 439046DF12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046CB12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp */; };
</del><span class="cx"> 439046E012DA25E800BF80A3 /* RenderMathMLRadicalOperator.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CC12DA25E800BF80A3 /* RenderMathMLRadicalOperator.h */; };
</span><span class="cx"> 439046E112DA25E800AF80A2 /* RenderMathMLRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046CD12DA25E800AF80A2 /* RenderMathMLRoot.cpp */; };
</span><span class="cx"> 439046E212DA25E800AF80A2 /* RenderMathMLRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CE12DA25E800AF80A2 /* RenderMathMLRoot.h */; };
</span><span class="lines">@@ -2352,7 +2352,7 @@
</span><span class="cx"> 7AA3A69B194A64E7001CBD24 /* TileGrid.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AA3A697194A64E7001CBD24 /* TileGrid.cpp */; };
</span><span class="cx"> 7AA3A69C194A64E7001CBD24 /* TileGrid.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A698194A64E7001CBD24 /* TileGrid.h */; };
</span><span class="cx"> 7AA3A69F194B59B6001CBD24 /* LayerPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AA3A69D194B59B6001CBD24 /* LayerPool.cpp */; };
</span><del>- 7AA3A6A0194B59B6001CBD24 /* LayerPool.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A69E194B59B6001CBD24 /* LayerPool.h */; };
</del><ins>+ 7AA3A6A0194B59B6001CBD24 /* LayerPool.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A69E194B59B6001CBD24 /* LayerPool.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 7AA3A6A3194B5C22001CBD24 /* TileCoverageMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AA3A6A1194B5C22001CBD24 /* TileCoverageMap.cpp */; };
</span><span class="cx"> 7AA3A6A4194B5C22001CBD24 /* TileCoverageMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A6A2194B5C22001CBD24 /* TileCoverageMap.h */; };
</span><span class="cx"> 7AABA25914BC613300AA9A11 /* DOMEditor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AABA25714BC613300AA9A11 /* DOMEditor.cpp */; };
</span><span class="lines">@@ -8515,8 +8515,8 @@
</span><span class="cx"> 439046C912DA25E800AF80A2 /* RenderMathMLMath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLMath.cpp; path = mathml/RenderMathMLMath.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 439046CA12DA25E800AF80A2 /* RenderMathMLMath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLMath.h; path = mathml/RenderMathMLMath.h; sourceTree = "<group>"; };
</span><span class="cx"> 439046CB12DA25E800AF80A2 /* RenderMathMLOperator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLOperator.cpp; path = mathml/RenderMathMLOperator.cpp; sourceTree = "<group>"; };
</span><ins>+ 439046CB12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLRadicalOperator.cpp; path = mathml/RenderMathMLRadicalOperator.cpp; sourceTree = "<group>"; };
</ins><span class="cx"> 439046CC12DA25E800AF80A2 /* RenderMathMLOperator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLOperator.h; path = mathml/RenderMathMLOperator.h; sourceTree = "<group>"; };
</span><del>- 439046CB12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLRadicalOperator.cpp; path = mathml/RenderMathMLRadicalOperator.cpp; sourceTree = "<group>"; };
</del><span class="cx"> 439046CC12DA25E800BF80A3 /* RenderMathMLRadicalOperator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLRadicalOperator.h; path = mathml/RenderMathMLRadicalOperator.h; sourceTree = "<group>"; };
</span><span class="cx"> 439046CD12DA25E800AF80A2 /* RenderMathMLRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLRoot.cpp; path = mathml/RenderMathMLRoot.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 439046CE12DA25E800AF80A2 /* RenderMathMLRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLRoot.h; path = mathml/RenderMathMLRoot.h; sourceTree = "<group>"; };
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformcocoaMemoryPressureHandlerCocoamm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/cocoa/MemoryPressureHandlerCocoa.mm (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/cocoa/MemoryPressureHandlerCocoa.mm 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/platform/cocoa/MemoryPressureHandlerCocoa.mm 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -48,8 +48,9 @@
</span><span class="cx"> void MemoryPressureHandler::platformReleaseMemory(bool)
</span><span class="cx"> {
</span><span class="cx"> {
</span><del>- ReliefLogger log("Drain LayerPool");
- LayerPool::sharedPool()->drain();
</del><ins>+ ReliefLogger log("Drain LayerPools");
+ for (auto& pool : LayerPool::allLayerPools())
+ pool->drain();
</ins><span class="cx"> }
</span><span class="cx"> #if USE(IOSURFACE)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscaLayerPoolcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ca/LayerPool.cpp (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ca/LayerPool.cpp 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/platform/graphics/ca/LayerPool.cpp 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx">
</span><span class="cx"> #include "Logging.h"
</span><span class="cx"> #include <wtf/CurrentTime.h>
</span><ins>+#include <wtf/NeverDestroyed.h>
</ins><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="lines">@@ -39,14 +40,20 @@
</span><span class="cx"> , m_pruneTimer(this, &LayerPool::pruneTimerFired)
</span><span class="cx"> , m_lastAddTime(0)
</span><span class="cx"> {
</span><ins>+ allLayerPools().add(this);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-LayerPool* LayerPool::sharedPool()
</del><ins>+LayerPool::~LayerPool()
</ins><span class="cx"> {
</span><del>- static LayerPool* sharedPool = new LayerPool;
- return sharedPool;
</del><ins>+ allLayerPools().remove(this);
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+HashSet<LayerPool*>& LayerPool::allLayerPools()
+{
+ static NeverDestroyed<HashSet<LayerPool*>> allLayerPools;
+ return allLayerPools.get();
+}
+
</ins><span class="cx"> unsigned LayerPool::backingStoreBytesForSize(const IntSize& size)
</span><span class="cx"> {
</span><span class="cx"> return size.width() * size.height() * 4;
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscaLayerPoolh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ca/LayerPool.h (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ca/LayerPool.h 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/platform/graphics/ca/LayerPool.h 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -41,7 +41,10 @@
</span><span class="cx"> class LayerPool {
</span><span class="cx"> WTF_MAKE_NONCOPYABLE(LayerPool);
</span><span class="cx"> public:
</span><del>- static LayerPool* sharedPool();
</del><ins>+ LayerPool();
+ ~LayerPool();
+
+ static HashSet<LayerPool*>& allLayerPools();
</ins><span class="cx">
</span><span class="cx"> void addLayer(const RefPtr<PlatformCALayer>&);
</span><span class="cx"> RefPtr<PlatformCALayer> takeLayerWithSize(const IntSize&);
</span><span class="lines">@@ -52,8 +55,6 @@
</span><span class="cx"> unsigned capacity() const { return m_maxBytesForPool; }
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- LayerPool();
-
</del><span class="cx"> typedef Deque<RefPtr<PlatformCALayer>> LayerList;
</span><span class="cx">
</span><span class="cx"> unsigned decayedCapacity() const;
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscaPlatformCALayercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -24,6 +24,7 @@
</span><span class="cx"> */
</span><span class="cx">
</span><span class="cx"> #include "config.h"
</span><ins>+#include "LayerPool.h"
</ins><span class="cx"> #include "PlatformCALayer.h"
</span><span class="cx"> #include <wtf/StringExtras.h>
</span><span class="cx">
</span><span class="lines">@@ -91,6 +92,33 @@
</span><span class="cx"> CGContextRestoreGState(context);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+PassRefPtr<PlatformCALayer> PlatformCALayer::createCompatibleLayerOrTakeFromPool(PlatformCALayer::LayerType layerType, PlatformCALayerClient* client, IntSize size)
+{
+ RefPtr<PlatformCALayer> layer;
+
+ if ((layer = layerPool().takeLayerWithSize(size))) {
+ layer->setOwner(client);
+ return layer.release();
+ }
+
+ layer = createCompatibleLayer(layerType, client);
+ layer->setBounds(FloatRect(FloatPoint(), size));
+
+ return layer.release();
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+void PlatformCALayer::moveToLayerPool()
+{
+ ASSERT(!superlayer());
+ layerPool().addLayer(this);
+}
+
+LayerPool& PlatformCALayer::layerPool()
+{
+ static LayerPool* sharedPool = new LayerPool;
+ return *sharedPool;
+}
+
+}
+
</ins><span class="cx"> #endif // USE(CA)
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscaPlatformCALayerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.h (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.h 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/platform/graphics/ca/PlatformCALayer.h 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -46,6 +46,7 @@
</span><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><ins>+class LayerPool;
</ins><span class="cx"> class PlatformCALayer;
</span><span class="cx"> class PlatformCAAnimation;
</span><span class="cx">
</span><span class="lines">@@ -223,6 +224,7 @@
</span><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> virtual PassRefPtr<PlatformCALayer> createCompatibleLayer(LayerType, PlatformCALayerClient*) const = 0;
</span><ins>+ PassRefPtr<PlatformCALayer> createCompatibleLayerOrTakeFromPool(LayerType layerType, PlatformCALayerClient* client, IntSize);
</ins><span class="cx">
</span><span class="cx"> #if PLATFORM(COCOA)
</span><span class="cx"> virtual void enumerateRectsBeingDrawn(CGContextRef, void (^block)(CGRect)) = 0;
</span><span class="lines">@@ -243,9 +245,13 @@
</span><span class="cx"> static void drawRepaintIndicator(CGContextRef, PlatformCALayer*, int repaintCount, CGColorRef customBackgroundColor);
</span><span class="cx"> static CGRect frameForLayer(const PlatformLayer*);
</span><span class="cx">
</span><ins>+ void moveToLayerPool();
+
</ins><span class="cx"> protected:
</span><span class="cx"> PlatformCALayer(LayerType, PlatformCALayerClient* owner);
</span><span class="cx">
</span><ins>+ virtual LayerPool& layerPool();
+
</ins><span class="cx"> const LayerType m_layerType;
</span><span class="cx"> const GraphicsLayer::PlatformLayerID m_layerID;
</span><span class="cx"> RetainPtr<PlatformLayer> m_layer;
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscaTileControllercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ca/TileController.cpp (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ca/TileController.cpp 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/platform/graphics/ca/TileController.cpp 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -27,7 +27,6 @@
</span><span class="cx"> #include "TileController.h"
</span><span class="cx">
</span><span class="cx"> #include "IntRect.h"
</span><del>-#include "LayerPool.h"
</del><span class="cx"> #include "PlatformCALayer.h"
</span><span class="cx"> #include "Region.h"
</span><span class="cx"> #include "TileCoverageMap.h"
</span><span class="lines">@@ -490,15 +489,9 @@
</span><span class="cx">
</span><span class="cx"> RefPtr<PlatformCALayer> TileController::createTileLayer(const IntRect& tileRect, TileGrid& grid)
</span><span class="cx"> {
</span><del>- RefPtr<PlatformCALayer> layer = LayerPool::sharedPool()->takeLayerWithSize(tileRect.size());
</del><ins>+ RefPtr<PlatformCALayer> layer = m_tileCacheLayer->createCompatibleLayerOrTakeFromPool(PlatformCALayer::LayerTypeTiledBackingTileLayer, &grid, tileRect.size());
</ins><span class="cx">
</span><del>- if (layer)
- layer->setOwner(&grid);
- else
- layer = m_tileCacheLayer->createCompatibleLayer(PlatformCALayer::LayerTypeTiledBackingTileLayer, &grid);
-
</del><span class="cx"> layer->setAnchorPoint(FloatPoint3D());
</span><del>- layer->setBounds(FloatRect(FloatPoint(), tileRect.size()));
</del><span class="cx"> layer->setPosition(tileRect.location());
</span><span class="cx"> layer->setBorderColor(m_tileDebugBorderColor);
</span><span class="cx"> layer->setBorderWidth(m_tileDebugBorderWidth);
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscaTileGridcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ca/TileGrid.cpp (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ca/TileGrid.cpp 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebCore/platform/graphics/ca/TileGrid.cpp 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -264,7 +264,7 @@
</span><span class="cx"> TileInfo tileInfo = m_tiles.take(toRemove[i]);
</span><span class="cx"> tileInfo.layer->removeFromSuperlayer();
</span><span class="cx"> m_tileRepaintCounts.remove(tileInfo.layer.get());
</span><del>- LayerPool::sharedPool()->addLayer(tileInfo.layer);
</del><ins>+ tileInfo.layer->moveToLayerPool();
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/ChangeLog 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebKit2/ChangeLog 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -1,5 +1,24 @@
</span><span class="cx"> 2014-06-20 Tim Horton <timothy_horton@apple.com>
</span><span class="cx">
</span><ins>+ LayerPool’d PlatformCALayerRemote/RemoteLayerBackingStore can have stale context pointers
+ https://bugs.webkit.org/show_bug.cgi?id=134050
+ <rdar://problem/17315114>
+
+ Reviewed by Simon Fraser.
+
+ * WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
+ (WebKit::PlatformCALayerRemote::recursiveBuildTransaction):
+ (WebKit::PlatformCALayerRemote::layerPool):
+ * WebProcess/WebPage/mac/PlatformCALayerRemote.h:
+ * WebProcess/WebPage/mac/RemoteLayerTreeContext.h:
+ (WebKit::RemoteLayerTreeContext::layerPool):
+ * WebProcess/WebPage/mac/RemoteLayerTreeContext.mm:
+ (WebKit::RemoteLayerTreeContext::buildTransaction):
+ Ensure that layers being committed are always in the context that is committing them.
+ Use a LayerPool per RemoteLayerTreeContext, to avoid moving layers between contexts.
+
+2014-06-20 Tim Horton <timothy_horton@apple.com>
+
</ins><span class="cx"> WKContentViewInteraction isn't cleaned up when the Web Content process crashes
</span><span class="cx"> https://bugs.webkit.org/show_bug.cgi?id=134080
</span><span class="cx"> <rdar://problem/17387652> and <rdar://problem/16848360>
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessWebPagemacPlatformCALayerRemotecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.cpp (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.cpp 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.cpp 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -117,9 +117,10 @@
</span><span class="cx"> m_context->layerWillBeDestroyed(this);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void PlatformCALayerRemote::recursiveBuildTransaction(RemoteLayerTreeTransaction& transaction)
</del><ins>+void PlatformCALayerRemote::recursiveBuildTransaction(RemoteLayerTreeContext& context, RemoteLayerTreeTransaction& transaction)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(!m_properties.backingStore || owner());
</span><ins>+ ASSERT_WITH_SECURITY_IMPLICATION(&context == m_context);
</ins><span class="cx">
</span><span class="cx"> if (m_properties.backingStore && (!owner() || !owner()->platformCALayerDrawsContent())) {
</span><span class="cx"> m_properties.backingStore = nullptr;
</span><span class="lines">@@ -148,11 +149,11 @@
</span><span class="cx"> for (size_t i = 0; i < m_children.size(); ++i) {
</span><span class="cx"> PlatformCALayerRemote* child = toPlatformCALayerRemote(m_children[i].get());
</span><span class="cx"> ASSERT(child->superlayer() == this);
</span><del>- child->recursiveBuildTransaction(transaction);
</del><ins>+ child->recursiveBuildTransaction(context, transaction);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (m_maskLayer)
</span><del>- m_maskLayer->recursiveBuildTransaction(transaction);
</del><ins>+ m_maskLayer->recursiveBuildTransaction(context, transaction);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void PlatformCALayerRemote::didCommit()
</span><span class="lines">@@ -657,4 +658,9 @@
</span><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+LayerPool& PlatformCALayerRemote::layerPool()
+{
+ return m_context->layerPool();
+}
+
</ins><span class="cx"> } // namespace WebKit
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessWebPagemacPlatformCALayerRemoteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.h (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.h 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.h 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -31,6 +31,10 @@
</span><span class="cx"> #include <WebCore/PlatformLayer.h>
</span><span class="cx"> #include <WebCore/TileController.h>
</span><span class="cx">
</span><ins>+namespace WebCore {
+class LayerPool;
+}
+
</ins><span class="cx"> namespace WebKit {
</span><span class="cx">
</span><span class="cx"> class RemoteLayerTreeContext;
</span><span class="lines">@@ -45,7 +49,7 @@
</span><span class="cx">
</span><span class="cx"> virtual PlatformLayer* platformLayer() const override { return nullptr; }
</span><span class="cx">
</span><del>- void recursiveBuildTransaction(RemoteLayerTreeTransaction&);
</del><ins>+ void recursiveBuildTransaction(RemoteLayerTreeContext&, RemoteLayerTreeTransaction&);
</ins><span class="cx">
</span><span class="cx"> virtual void setNeedsDisplay(const WebCore::FloatRect* dirtyRect = 0) override;
</span><span class="cx">
</span><span class="lines">@@ -175,6 +179,8 @@
</span><span class="cx">
</span><span class="cx"> bool requiresCustomAppearanceUpdateOnBoundsChange() const;
</span><span class="cx">
</span><ins>+ virtual WebCore::LayerPool& layerPool() override;
+
</ins><span class="cx"> RemoteLayerTreeTransaction::LayerProperties m_properties;
</span><span class="cx"> WebCore::PlatformCALayerList m_children;
</span><span class="cx"> PlatformCALayerRemote* m_superlayer;
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessWebPagemacRemoteLayerTreeContexth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.h (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.h 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.h 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> #include "RemoteLayerTreeTransaction.h"
</span><span class="cx"> #include "WebPage.h"
</span><span class="cx"> #include <WebCore/GraphicsLayerFactory.h>
</span><ins>+#include <WebCore/LayerPool.h>
</ins><span class="cx"> #include <WebCore/PlatformCALayer.h>
</span><span class="cx"> #include <wtf/Vector.h>
</span><span class="cx">
</span><span class="lines">@@ -52,6 +53,8 @@
</span><span class="cx"> void backingStoreWillBeDestroyed(RemoteLayerBackingStore*);
</span><span class="cx"> void backingStoreWillBeDisplayed(RemoteLayerBackingStore*);
</span><span class="cx">
</span><ins>+ WebCore::LayerPool& layerPool() { return m_layerPool; }
+
</ins><span class="cx"> LayerHostingMode layerHostingMode() const { return m_webPage->layerHostingMode(); }
</span><span class="cx">
</span><span class="cx"> void buildTransaction(RemoteLayerTreeTransaction&, WebCore::PlatformCALayer& rootLayer);
</span><span class="lines">@@ -80,6 +83,8 @@
</span><span class="cx"> RemoteLayerBackingStoreCollection m_backingStoreCollection;
</span><span class="cx">
</span><span class="cx"> RemoteLayerTreeTransaction* m_currentTransaction;
</span><ins>+
+ WebCore::LayerPool m_layerPool;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace WebKit
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessWebPagemacRemoteLayerTreeContextmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.mm (170178 => 170179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.mm 2014-06-20 07:31:04 UTC (rev 170178)
+++ trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.mm 2014-06-20 07:33:58 UTC (rev 170179)
</span><span class="lines">@@ -103,7 +103,7 @@
</span><span class="cx"> transaction.setRootLayerID(rootLayerRemote.layerID());
</span><span class="cx">
</span><span class="cx"> m_currentTransaction = &transaction;
</span><del>- rootLayerRemote.recursiveBuildTransaction(transaction);
</del><ins>+ rootLayerRemote.recursiveBuildTransaction(*this, transaction);
</ins><span class="cx"> m_currentTransaction = nullptr;
</span><span class="cx">
</span><span class="cx"> transaction.setCreatedLayers(std::move(m_createdLayers));
</span></span></pre>
</div>
</div>
</body>
</html>