https://bugs.webkit.org/show_bug.cgi?id=134050
<rdar://problem/
17315114>
Reviewed by Simon Fraser.
* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(WebKit::PlatformCALayerRemote::recursiveBuildTransaction):
(WebKit::PlatformCALayerRemote::layerPool):
* WebProcess/WebPage/mac/PlatformCALayerRemote.h:
* WebProcess/WebPage/mac/RemoteLayerTreeContext.h:
(WebKit::RemoteLayerTreeContext::layerPool):
* WebProcess/WebPage/mac/RemoteLayerTreeContext.mm:
(WebKit::RemoteLayerTreeContext::buildTransaction):
Ensure that layers being committed are always in the context that is committing them.
Use a LayerPool per RemoteLayerTreeContext, to avoid moving layers between contexts.
* WebCore.exp.in:
* WebCore.xcodeproj/project.pbxproj:
* platform/cocoa/MemoryPressureHandlerCocoa.mm:
(WebCore::MemoryPressureHandler::platformReleaseMemory):
Drain all LayerPools upon memory pressure.
* platform/graphics/ca/LayerPool.cpp:
(WebCore::LayerPool::LayerPool):
(WebCore::LayerPool::~LayerPool):
(WebCore::LayerPool::allLayerPools):
(WebCore::LayerPool::sharedPool): Deleted.
* platform/graphics/ca/LayerPool.h:
* platform/graphics/ca/PlatformCALayer.cpp:
(WebCore::PlatformCALayer::createCompatibleLayerWithSize):
Add createCompatibleLayerWithSize, which optionally tries to take said layer from the LayerPool.
(WebCore::PlatformCALayer::moveToLayerPool):
Add moveToLayerPool, which moves the layer to the LayerPool.
(WebCore::PlatformCALayer::layerPool):
The LayerPool for each layer is obtained via PlatformCALayer::layerPool(), which subclasses can override for special behaviors.
The base class uses a global LayerPool.
* platform/graphics/ca/PlatformCALayer.h:
* platform/graphics/ca/TileController.cpp:
(WebCore::TileController::createTileLayer):
* platform/graphics/ca/TileGrid.cpp:
(WebCore::TileGrid::removeTiles):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@170179
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2014-06-20 Tim Horton <timothy_horton@apple.com>
+
+ LayerPool’d PlatformCALayerRemote/RemoteLayerBackingStore can have stale context pointers
+ https://bugs.webkit.org/show_bug.cgi?id=134050
+ <rdar://problem/17315114>
+
+ Reviewed by Simon Fraser.
+
+ * WebCore.exp.in:
+ * WebCore.xcodeproj/project.pbxproj:
+ * platform/cocoa/MemoryPressureHandlerCocoa.mm:
+ (WebCore::MemoryPressureHandler::platformReleaseMemory):
+ Drain all LayerPools upon memory pressure.
+
+ * platform/graphics/ca/LayerPool.cpp:
+ (WebCore::LayerPool::LayerPool):
+ (WebCore::LayerPool::~LayerPool):
+ (WebCore::LayerPool::allLayerPools):
+ (WebCore::LayerPool::sharedPool): Deleted.
+ * platform/graphics/ca/LayerPool.h:
+ * platform/graphics/ca/PlatformCALayer.cpp:
+ (WebCore::PlatformCALayer::createCompatibleLayerWithSize):
+ Add createCompatibleLayerWithSize, which optionally tries to take said layer from the LayerPool.
+
+ (WebCore::PlatformCALayer::moveToLayerPool):
+ Add moveToLayerPool, which moves the layer to the LayerPool.
+
+ (WebCore::PlatformCALayer::layerPool):
+ The LayerPool for each layer is obtained via PlatformCALayer::layerPool(), which subclasses can override for special behaviors.
+ The base class uses a global LayerPool.
+
+ * platform/graphics/ca/PlatformCALayer.h:
+ * platform/graphics/ca/TileController.cpp:
+ (WebCore::TileController::createTileLayer):
+ * platform/graphics/ca/TileGrid.cpp:
+ (WebCore::TileGrid::removeTiles):
+
2014-06-19 Carlos Garcia Campos <cgarcia@igalia.com>
[GTK] webkit_dom_document_create_tree_walker impossible to use due to WebKitDOMNodeFilter
__ZN7WebCore9InlineBox14selectionStateEv
__ZN7WebCore9InlineBox16placeEllipsisBoxEbfffRfRb
__ZN7WebCore9JSElement6s_infoE
+__ZN7WebCore9LayerPoolC1Ev
+__ZN7WebCore9LayerPoolD1Ev
__ZN7WebCore9PageCache11setCapacityEi
__ZN7WebCore9PageCache33markPagesForVistedLinkStyleRecalcEv
__ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
439046DD12DA25E800AF80A2 /* RenderMathMLMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046C912DA25E800AF80A2 /* RenderMathMLMath.cpp */; };
439046DE12DA25E800AF80A2 /* RenderMathMLMath.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CA12DA25E800AF80A2 /* RenderMathMLMath.h */; };
439046DF12DA25E800AF80A2 /* RenderMathMLOperator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046CB12DA25E800AF80A2 /* RenderMathMLOperator.cpp */; };
- 439046E012DA25E800AF80A2 /* RenderMathMLOperator.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CC12DA25E800AF80A2 /* RenderMathMLOperator.h */; };
439046DF12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046CB12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp */; };
+ 439046E012DA25E800AF80A2 /* RenderMathMLOperator.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CC12DA25E800AF80A2 /* RenderMathMLOperator.h */; };
439046E012DA25E800BF80A3 /* RenderMathMLRadicalOperator.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CC12DA25E800BF80A3 /* RenderMathMLRadicalOperator.h */; };
439046E112DA25E800AF80A2 /* RenderMathMLRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046CD12DA25E800AF80A2 /* RenderMathMLRoot.cpp */; };
439046E212DA25E800AF80A2 /* RenderMathMLRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046CE12DA25E800AF80A2 /* RenderMathMLRoot.h */; };
7AA3A69B194A64E7001CBD24 /* TileGrid.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AA3A697194A64E7001CBD24 /* TileGrid.cpp */; };
7AA3A69C194A64E7001CBD24 /* TileGrid.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A698194A64E7001CBD24 /* TileGrid.h */; };
7AA3A69F194B59B6001CBD24 /* LayerPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AA3A69D194B59B6001CBD24 /* LayerPool.cpp */; };
- 7AA3A6A0194B59B6001CBD24 /* LayerPool.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A69E194B59B6001CBD24 /* LayerPool.h */; };
+ 7AA3A6A0194B59B6001CBD24 /* LayerPool.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A69E194B59B6001CBD24 /* LayerPool.h */; settings = {ATTRIBUTES = (Private, ); }; };
7AA3A6A3194B5C22001CBD24 /* TileCoverageMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AA3A6A1194B5C22001CBD24 /* TileCoverageMap.cpp */; };
7AA3A6A4194B5C22001CBD24 /* TileCoverageMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA3A6A2194B5C22001CBD24 /* TileCoverageMap.h */; };
7AABA25914BC613300AA9A11 /* DOMEditor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AABA25714BC613300AA9A11 /* DOMEditor.cpp */; };
439046C912DA25E800AF80A2 /* RenderMathMLMath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLMath.cpp; path = mathml/RenderMathMLMath.cpp; sourceTree = "<group>"; };
439046CA12DA25E800AF80A2 /* RenderMathMLMath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLMath.h; path = mathml/RenderMathMLMath.h; sourceTree = "<group>"; };
439046CB12DA25E800AF80A2 /* RenderMathMLOperator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLOperator.cpp; path = mathml/RenderMathMLOperator.cpp; sourceTree = "<group>"; };
- 439046CC12DA25E800AF80A2 /* RenderMathMLOperator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLOperator.h; path = mathml/RenderMathMLOperator.h; sourceTree = "<group>"; };
439046CB12DA25E800BF80A3 /* RenderMathMLRadicalOperator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLRadicalOperator.cpp; path = mathml/RenderMathMLRadicalOperator.cpp; sourceTree = "<group>"; };
+ 439046CC12DA25E800AF80A2 /* RenderMathMLOperator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLOperator.h; path = mathml/RenderMathMLOperator.h; sourceTree = "<group>"; };
439046CC12DA25E800BF80A3 /* RenderMathMLRadicalOperator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLRadicalOperator.h; path = mathml/RenderMathMLRadicalOperator.h; sourceTree = "<group>"; };
439046CD12DA25E800AF80A2 /* RenderMathMLRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLRoot.cpp; path = mathml/RenderMathMLRoot.cpp; sourceTree = "<group>"; };
439046CE12DA25E800AF80A2 /* RenderMathMLRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLRoot.h; path = mathml/RenderMathMLRoot.h; sourceTree = "<group>"; };
void MemoryPressureHandler::platformReleaseMemory(bool)
{
{
- ReliefLogger log("Drain LayerPool");
- LayerPool::sharedPool()->drain();
+ ReliefLogger log("Drain LayerPools");
+ for (auto& pool : LayerPool::allLayerPools())
+ pool->drain();
}
#if USE(IOSURFACE)
{
#include "Logging.h"
#include <wtf/CurrentTime.h>
+#include <wtf/NeverDestroyed.h>
namespace WebCore {
, m_pruneTimer(this, &LayerPool::pruneTimerFired)
, m_lastAddTime(0)
{
+ allLayerPools().add(this);
}
-LayerPool* LayerPool::sharedPool()
+LayerPool::~LayerPool()
{
- static LayerPool* sharedPool = new LayerPool;
- return sharedPool;
+ allLayerPools().remove(this);
+}
+
+HashSet<LayerPool*>& LayerPool::allLayerPools()
+{
+ static NeverDestroyed<HashSet<LayerPool*>> allLayerPools;
+ return allLayerPools.get();
}
unsigned LayerPool::backingStoreBytesForSize(const IntSize& size)
class LayerPool {
WTF_MAKE_NONCOPYABLE(LayerPool);
public:
- static LayerPool* sharedPool();
+ LayerPool();
+ ~LayerPool();
+
+ static HashSet<LayerPool*>& allLayerPools();
void addLayer(const RefPtr<PlatformCALayer>&);
RefPtr<PlatformCALayer> takeLayerWithSize(const IntSize&);
unsigned capacity() const { return m_maxBytesForPool; }
private:
- LayerPool();
-
typedef Deque<RefPtr<PlatformCALayer>> LayerList;
unsigned decayedCapacity() const;
*/
#include "config.h"
+#include "LayerPool.h"
#include "PlatformCALayer.h"
#include <wtf/StringExtras.h>
CGContextRestoreGState(context);
}
+PassRefPtr<PlatformCALayer> PlatformCALayer::createCompatibleLayerOrTakeFromPool(PlatformCALayer::LayerType layerType, PlatformCALayerClient* client, IntSize size)
+{
+ RefPtr<PlatformCALayer> layer;
+
+ if ((layer = layerPool().takeLayerWithSize(size))) {
+ layer->setOwner(client);
+ return layer.release();
+ }
+
+ layer = createCompatibleLayer(layerType, client);
+ layer->setBounds(FloatRect(FloatPoint(), size));
+
+ return layer.release();
+}
+
+void PlatformCALayer::moveToLayerPool()
+{
+ ASSERT(!superlayer());
+ layerPool().addLayer(this);
+}
+
+LayerPool& PlatformCALayer::layerPool()
+{
+ static LayerPool* sharedPool = new LayerPool;
+ return *sharedPool;
+}
+
}
#endif // USE(CA)
namespace WebCore {
+class LayerPool;
class PlatformCALayer;
class PlatformCAAnimation;
#endif
virtual PassRefPtr<PlatformCALayer> createCompatibleLayer(LayerType, PlatformCALayerClient*) const = 0;
+ PassRefPtr<PlatformCALayer> createCompatibleLayerOrTakeFromPool(LayerType layerType, PlatformCALayerClient* client, IntSize);
#if PLATFORM(COCOA)
virtual void enumerateRectsBeingDrawn(CGContextRef, void (^block)(CGRect)) = 0;
static void drawRepaintIndicator(CGContextRef, PlatformCALayer*, int repaintCount, CGColorRef customBackgroundColor);
static CGRect frameForLayer(const PlatformLayer*);
+ void moveToLayerPool();
+
protected:
PlatformCALayer(LayerType, PlatformCALayerClient* owner);
+ virtual LayerPool& layerPool();
+
const LayerType m_layerType;
const GraphicsLayer::PlatformLayerID m_layerID;
RetainPtr<PlatformLayer> m_layer;
#include "TileController.h"
#include "IntRect.h"
-#include "LayerPool.h"
#include "PlatformCALayer.h"
#include "Region.h"
#include "TileCoverageMap.h"
RefPtr<PlatformCALayer> TileController::createTileLayer(const IntRect& tileRect, TileGrid& grid)
{
- RefPtr<PlatformCALayer> layer = LayerPool::sharedPool()->takeLayerWithSize(tileRect.size());
-
- if (layer)
- layer->setOwner(&grid);
- else
- layer = m_tileCacheLayer->createCompatibleLayer(PlatformCALayer::LayerTypeTiledBackingTileLayer, &grid);
+ RefPtr<PlatformCALayer> layer = m_tileCacheLayer->createCompatibleLayerOrTakeFromPool(PlatformCALayer::LayerTypeTiledBackingTileLayer, &grid, tileRect.size());
layer->setAnchorPoint(FloatPoint3D());
- layer->setBounds(FloatRect(FloatPoint(), tileRect.size()));
layer->setPosition(tileRect.location());
layer->setBorderColor(m_tileDebugBorderColor);
layer->setBorderWidth(m_tileDebugBorderWidth);
TileInfo tileInfo = m_tiles.take(toRemove[i]);
tileInfo.layer->removeFromSuperlayer();
m_tileRepaintCounts.remove(tileInfo.layer.get());
- LayerPool::sharedPool()->addLayer(tileInfo.layer);
+ tileInfo.layer->moveToLayerPool();
}
}
+2014-06-20 Tim Horton <timothy_horton@apple.com>
+
+ LayerPool’d PlatformCALayerRemote/RemoteLayerBackingStore can have stale context pointers
+ https://bugs.webkit.org/show_bug.cgi?id=134050
+ <rdar://problem/17315114>
+
+ Reviewed by Simon Fraser.
+
+ * WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
+ (WebKit::PlatformCALayerRemote::recursiveBuildTransaction):
+ (WebKit::PlatformCALayerRemote::layerPool):
+ * WebProcess/WebPage/mac/PlatformCALayerRemote.h:
+ * WebProcess/WebPage/mac/RemoteLayerTreeContext.h:
+ (WebKit::RemoteLayerTreeContext::layerPool):
+ * WebProcess/WebPage/mac/RemoteLayerTreeContext.mm:
+ (WebKit::RemoteLayerTreeContext::buildTransaction):
+ Ensure that layers being committed are always in the context that is committing them.
+ Use a LayerPool per RemoteLayerTreeContext, to avoid moving layers between contexts.
+
2014-06-20 Tim Horton <timothy_horton@apple.com>
WKContentViewInteraction isn't cleaned up when the Web Content process crashes
m_context->layerWillBeDestroyed(this);
}
-void PlatformCALayerRemote::recursiveBuildTransaction(RemoteLayerTreeTransaction& transaction)
+void PlatformCALayerRemote::recursiveBuildTransaction(RemoteLayerTreeContext& context, RemoteLayerTreeTransaction& transaction)
{
ASSERT(!m_properties.backingStore || owner());
+ ASSERT_WITH_SECURITY_IMPLICATION(&context == m_context);
if (m_properties.backingStore && (!owner() || !owner()->platformCALayerDrawsContent())) {
m_properties.backingStore = nullptr;
for (size_t i = 0; i < m_children.size(); ++i) {
PlatformCALayerRemote* child = toPlatformCALayerRemote(m_children[i].get());
ASSERT(child->superlayer() == this);
- child->recursiveBuildTransaction(transaction);
+ child->recursiveBuildTransaction(context, transaction);
}
if (m_maskLayer)
- m_maskLayer->recursiveBuildTransaction(transaction);
+ m_maskLayer->recursiveBuildTransaction(context, transaction);
}
void PlatformCALayerRemote::didCommit()
return 0;
}
+LayerPool& PlatformCALayerRemote::layerPool()
+{
+ return m_context->layerPool();
+}
+
} // namespace WebKit
#include <WebCore/PlatformLayer.h>
#include <WebCore/TileController.h>
+namespace WebCore {
+class LayerPool;
+}
+
namespace WebKit {
class RemoteLayerTreeContext;
virtual PlatformLayer* platformLayer() const override { return nullptr; }
- void recursiveBuildTransaction(RemoteLayerTreeTransaction&);
+ void recursiveBuildTransaction(RemoteLayerTreeContext&, RemoteLayerTreeTransaction&);
virtual void setNeedsDisplay(const WebCore::FloatRect* dirtyRect = 0) override;
bool requiresCustomAppearanceUpdateOnBoundsChange() const;
+ virtual WebCore::LayerPool& layerPool() override;
+
RemoteLayerTreeTransaction::LayerProperties m_properties;
WebCore::PlatformCALayerList m_children;
PlatformCALayerRemote* m_superlayer;
#include "RemoteLayerTreeTransaction.h"
#include "WebPage.h"
#include <WebCore/GraphicsLayerFactory.h>
+#include <WebCore/LayerPool.h>
#include <WebCore/PlatformCALayer.h>
#include <wtf/Vector.h>
void backingStoreWillBeDestroyed(RemoteLayerBackingStore*);
void backingStoreWillBeDisplayed(RemoteLayerBackingStore*);
+ WebCore::LayerPool& layerPool() { return m_layerPool; }
+
LayerHostingMode layerHostingMode() const { return m_webPage->layerHostingMode(); }
void buildTransaction(RemoteLayerTreeTransaction&, WebCore::PlatformCALayer& rootLayer);
RemoteLayerBackingStoreCollection m_backingStoreCollection;
RemoteLayerTreeTransaction* m_currentTransaction;
+
+ WebCore::LayerPool m_layerPool;
};
} // namespace WebKit
transaction.setRootLayerID(rootLayerRemote.layerID());
m_currentTransaction = &transaction;
- rootLayerRemote.recursiveBuildTransaction(transaction);
+ rootLayerRemote.recursiveBuildTransaction(*this, transaction);
m_currentTransaction = nullptr;
transaction.setCreatedLayers(std::move(m_createdLayers));