Cherry-pick fe4af8b. rdar://problem/109380900

    Cherry-pick 264460@main (fe4af8b). <rdar://109380900>

        [Cocoa] Call [AVCaptureDevice ensureServerConnection] when new extensions are made to the GPU Process
        https://bugs.webkit.org/show_bug.cgi?id=257241
        <rdar://109380900>

        Reviewed by Eric Carlson.

        Our current code only calls [AVCaptureDevice ensureServerConnection] the first time we extend the sandbox.
        This can lead to problems if the user visits a site that only needs Microphone access (for example), and
        then visits a site that needs Camera access. Because the camera-related extensions are only recognized by
        the video capture system when [AVCaptureDevice ensureServiceConnection] is called, the fact that we called
        it before the new sandbox extensions were in place mean we never activate the relevant features.

        To fix this, we should simply call [AVCaptureDevice ensureServerConnection] any time we extend the sandbox.
        I have confirmed with the relevant teams that this call is low-cost (performance wise), and is not harmful
        to call repeatedly for things that have already been activated.

        This patch also adds new logging to help debug similar problems in the future.

        * Source/WebKit/GPUProcess/GPUProcess.cpp:
        (WebKit::GPUProcess::updateSandboxAccess): Add logging.
        (WebKit::GPUProcess::updateCaptureAccess): Ditto.
        * Source/WebKit/GPUProcess/cocoa/GPUProcessCocoa.mm:
        (WebKit::GPUProcess::ensureAVCaptureServerConnection): Add new logging, no longer make this a 'std::call_once'.

        Canonical link: https://commits.webkit.org/264460@main

Identifier: 263769.67@safari-7616.1.14.11-branch

Source/WebKit/GPUProcess/GPUProcess.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019-2022 Apple Inc. All rights reserved.
+ * Copyright (C) 2019-2023 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,6 +39,7 @@
 #include "GPUProcessProxyMessages.h"
 #include "GPUProcessSessionParameters.h"
 #include "LogInitialization.h"
+#include "Logging.h"
 #include "RemoteMediaPlayerManagerProxy.h"
 #include "SandboxExtension.h"
 #include "WebPageProxyMessages.h"
@@ -375,6 +376,13 @@ GPUConnectionToWebProcess* GPUProcess::webProcessConnection(WebCore::ProcessIden
     return m_webProcessConnections.get(identifier);
 }
 
+void GPUProcess::updateSandboxAccess(const Vector<SandboxExtension::Handle>& extensions)
+{
+    RELEASE_LOG(WebRTC, "GPUProcess::updateSandboxAccess: Adding %ld extensions", extensions.size());
+    for (auto& extension : extensions)
+        SandboxExtension::consumePermanently(extension);
+}
+
 #if ENABLE(MEDIA_STREAM)
 void GPUProcess::setMockCaptureDevicesEnabled(bool isEnabled)
 {
@@ -399,6 +407,8 @@ void GPUProcess::setOrientationForMediaCapture(IntDegrees orientation)
 
 void GPUProcess::updateCaptureAccess(bool allowAudioCapture, bool allowVideoCapture, bool allowDisplayCapture, WebCore::ProcessIdentifier processID, CompletionHandler<void()>&& completionHandler)
 {
+    RELEASE_LOG(WebRTC, "GPUProcess::updateCaptureAccess: Entering (audio=%d, video=%d, display=%d)", allowAudioCapture, allowVideoCapture, allowDisplayCapture);
+
 #if ENABLE(MEDIA_STREAM) && PLATFORM(COCOA)
     ensureAVCaptureServerConnection();
 #endif

Source/WebKit/GPUProcess/cocoa/GPUProcessCocoa.mm

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021-2022 Apple Inc. All rights reserved.
+ * Copyright (C) 2021-2023 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +31,7 @@
 #if ENABLE(GPU_PROCESS) && PLATFORM(COCOA)
 
 #import "GPUConnectionToWebProcess.h"
+#import "Logging.h"
 #import "RemoteRenderingBackend.h"
 #import <pal/spi/cocoa/AVFoundationSPI.h>
 #import <wtf/RetainPtr.h>
@@ -80,11 +81,11 @@
 #if ENABLE(MEDIA_STREAM)
 void GPUProcess::ensureAVCaptureServerConnection()
 {
-    static std::once_flag flag;
-    std::call_once(flag, [] {
-        if ([PAL::getAVCaptureDeviceClass() respondsToSelector:@selector(ensureServerConnection)])
-            [PAL::getAVCaptureDeviceClass() ensureServerConnection];
-    });
+    RELEASE_LOG(WebRTC, "GPUProcess::ensureAVCaptureServerConnection: Entering.");
+    if ([PAL::getAVCaptureDeviceClass() respondsToSelector:@selector(ensureServerConnection)]) {
+        RELEASE_LOG(WebRTC, "GPUProcess::ensureAVCaptureServerConnection: Calling [AVCaptureDevice ensureServerConnection]");
+        [PAL::getAVCaptureDeviceClass() ensureServerConnection];
+    }
 }
 #endif