REGRESSION(264617@main): fast/forms/ios/file-upload-panel-accept.html…

… is a constant timeout

https://bugs.webkit.org/show_bug.cgi?id=258901
rdar://110879270

Reviewed by Simon Fraser.

* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):
The explicit commit introduced in 264617@main caused multiple bits of unexpected
fallout, breaking a layout test and bypassing commit-coalescing optimizations
in UIKit.

Instead of explicitly committing, just hold on to the IOSurface ports until
the commit arrives in the render server. (We can't hold on to the whole
transaction because the ports are consumed when applying the backing store
to its layer).

Canonical link: https://commits.webkit.org/265825@main

Source/WebCore/PAL/pal/spi/cocoa/QuartzCoreSPI.h

@@ -193,6 +193,7 @@ typedef enum {
     kCATransactionPhasePreLayout,
     kCATransactionPhasePreCommit,
     kCATransactionPhasePostCommit,
+    kCATransactionPhasePostSynchronize = 5,
     kCATransactionPhaseNull = ~0u
 } CATransactionPhase;
 

Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm

@@ -152,10 +152,25 @@
 
 void RemoteLayerTreeDrawingAreaProxy::commitLayerTree(IPC::Connection& connection, const Vector<std::pair<RemoteLayerTreeTransaction, RemoteScrollingCoordinatorTransaction>>& transactions)
 {
-    [CATransaction begin];
-    for (auto& transaction : transactions)
+    Vector<MachSendRight> sendRights;
+    for (auto& transaction : transactions) {
+        // commitLayerTreeTransaction consumes the incoming buffers, so we need to grab them first.
+        for (auto& [layerID, properties] : transaction.first.changedLayerProperties()) {
+            const auto backingStoreProperties = properties->backingStoreProperties.get();
+            if (!backingStoreProperties)
+                continue;
+            if (const auto& backendHandle = backingStoreProperties->bufferHandle()) {
+                if (const auto* sendRight = std::get_if<MachSendRight>(&backendHandle.value()))
+                    sendRights.append(*sendRight);
+            }
+        }
+
         commitLayerTreeTransaction(connection, transaction.first, transaction.second);
-    [CATransaction commit];
+    }
+
+    // Keep IOSurface send rights alive until the commit makes it to the render server, otherwise we will
+    // prematurely drop the only reference to them, and `inUse` will be wrong for a brief window.
+    [CATransaction addCommitHandler:[sendRights = WTFMove(sendRights)]() { } forPhase:kCATransactionPhasePostSynchronize];
 }
 
 void RemoteLayerTreeDrawingAreaProxy::commitLayerTreeTransaction(IPC::Connection& connection, const RemoteLayerTreeTransaction& layerTreeTransaction, const RemoteScrollingCoordinatorTransaction& scrollingTreeTransaction)