Blame content process for media buffers allocated in the GPU Process

https://bugs.webkit.org/show_bug.cgi?id=241455 <rdar://94674194> Reviewed by Jer Noble. After copying the media content sent by the content process into a SharedMemory, we send its SharedMemory's handle back to the content process for it to blame the content. Covered by existing tests. * Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.cpp: (WebKit::RemoteMediaResourceManager::dataReceived): * Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.h: * Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.messages.in: * Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp: (WebKit::RemoteSourceBufferProxy::append): * Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.h: * Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.messages.in: * Source/WebKit/Platform/IPC/SharedBufferReference.cpp: (IPC::SharedBufferReference::sharedCopy const): * Source/WebKit/Platform/IPC/SharedBufferReference.h: * Source/WebKit/WebProcess/GPU/media/RemoteMediaResourceProxy.cpp: (WebKit::RemoteMediaResourceProxy::dataReceived): * Source/WebKit/WebProcess/GPU/media/SourceBufferPrivateRemote.cpp: (WebKit::SourceBufferPrivateRemote::append): Canonical link: https://commits.webkit.org/251426@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@295420 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Jun 9, 2022 · 98be1ea872b2721fc560d1311b8c8a264fbacecb · 98be1ea
1 parent 573079c
commit 98be1ea872b2721fc560d1311b8c8a264fbacecb
Show file tree

Hide file tree

Showing 10 changed files with 51 additions and 36 deletions.
diff --git a/Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.cpp b/Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.cpp
@@ -31,8 +31,10 @@
 #include "Connection.h"
 #include "RemoteMediaResource.h"
 #include "RemoteMediaResourceIdentifier.h"
+#include "SharedBufferReference.h"
 #include "WebCoreArgumentCoders.h"
 #include <WebCore/ResourceRequest.h>
+#include <wtf/Scope.h>
 
 namespace WebKit {
 
@@ -89,16 +91,24 @@ void RemoteMediaResourceManager::dataSent(RemoteMediaResourceIdentifier identifi
     resource->dataSent(bytesSent, totalBytesToBeSent);
 }
 
-void RemoteMediaResourceManager::dataReceived(RemoteMediaResourceIdentifier identifier, const SharedMemory::IPCHandle& bufferHandle)
+void RemoteMediaResourceManager::dataReceived(RemoteMediaResourceIdentifier identifier, IPC::SharedBufferReference&& buffer, CompletionHandler<void(SharedMemory::IPCHandle&&)>&& completionHandler)
 {
+    SharedMemory::Handle handle;
+
+    auto invokeCallbackAtScopeExit = makeScopeExit([&] {
+        completionHandler(SharedMemory::IPCHandle { WTFMove(handle), buffer.size() });
+    });
+
     auto* resource = m_remoteMediaResources.get(identifier);
     if (!resource)
         return;
 
-    auto sharedMemory = SharedMemory::map(bufferHandle.handle, SharedMemory::Protection::ReadOnly);
+    auto sharedMemory = buffer.sharedCopy();
     if (!sharedMemory)
         return;
-    resource->dataReceived(sharedMemory->createSharedBuffer(bufferHandle.dataSize));
+    sharedMemory->createHandle(handle, SharedMemory::Protection::ReadOnly);
+
+    resource->dataReceived(sharedMemory->createSharedBuffer(buffer.size()));
 }
 
 void RemoteMediaResourceManager::accessControlCheckFailed(RemoteMediaResourceIdentifier identifier, const ResourceError& error)

diff --git a/Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.h b/Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.h
@@ -38,6 +38,7 @@
 namespace IPC {
 class Connection;
 class Decoder;
+class SharedBufferReference;
 }
 
 namespace WebCore {
@@ -66,7 +67,7 @@ class RemoteMediaResourceManager
     void responseReceived(RemoteMediaResourceIdentifier, const WebCore::ResourceResponse&, bool, CompletionHandler<void(WebCore::ShouldContinuePolicyCheck)>&&);
     void redirectReceived(RemoteMediaResourceIdentifier, WebCore::ResourceRequest&&, const WebCore::ResourceResponse&, CompletionHandler<void(WebCore::ResourceRequest&&)>&&);
     void dataSent(RemoteMediaResourceIdentifier, uint64_t, uint64_t);
-    void dataReceived(RemoteMediaResourceIdentifier, const SharedMemory::IPCHandle& bufferHandle);
+    void dataReceived(RemoteMediaResourceIdentifier, IPC::SharedBufferReference&&, CompletionHandler<void(WebKit::SharedMemory::IPCHandle&&)>&&);
     void accessControlCheckFailed(RemoteMediaResourceIdentifier, const WebCore::ResourceError&);
     void loadFailed(RemoteMediaResourceIdentifier, const WebCore::ResourceError&);
     void loadFinished(RemoteMediaResourceIdentifier, const WebCore::NetworkLoadMetrics&);

diff --git a/Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.messages.in b/Source/WebKit/GPUProcess/media/RemoteMediaResourceManager.messages.in
@@ -29,7 +29,7 @@ messages -> RemoteMediaResourceManager NotRefCounted {
     ResponseReceived(WebKit::RemoteMediaResourceIdentifier identifier, WebCore::ResourceResponse response, bool didPassAccessControlCheck) -> (enum:bool WebCore::ShouldContinuePolicyCheck shouldContinue)
     RedirectReceived(WebKit::RemoteMediaResourceIdentifier identifier, WebCore::ResourceRequest request, WebCore::ResourceResponse response) -> (WebCore::ResourceRequest returnRequest)
     DataSent(WebKit::RemoteMediaResourceIdentifier identifier, uint64_t bytesSent, uint64_t totalBytesToBeSent)
-    DataReceived(WebKit::RemoteMediaResourceIdentifier identifier, WebKit::SharedMemory::IPCHandle data)
+    DataReceived(WebKit::RemoteMediaResourceIdentifier identifier, IPC::SharedBufferReference data) -> (WebKit::SharedMemory::IPCHandle remoteData)
     AccessControlCheckFailed(WebKit::RemoteMediaResourceIdentifier identifier, WebCore::ResourceError error)
     LoadFailed(WebKit::RemoteMediaResourceIdentifier identifier, WebCore::ResourceError error)
     LoadFinished(WebKit::RemoteMediaResourceIdentifier identifier, WebCore::NetworkLoadMetrics metrics)

diff --git a/Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp b/Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp
@@ -32,12 +32,14 @@
 #include "InitializationSegmentInfo.h"
 #include "RemoteMediaPlayerProxy.h"
 #include "RemoteSourceBufferProxyMessages.h"
+#include "SharedBufferReference.h"
 #include "SourceBufferPrivateRemoteMessages.h"
 #include <WebCore/AudioTrackPrivate.h>
 #include <WebCore/ContentType.h>
 #include <WebCore/MediaDescription.h>
 #include <WebCore/PlatformTimeRanges.h>
 #include <WebCore/VideoTrackPrivate.h>
+#include <wtf/Scope.h>
 
 namespace WebKit {
 
@@ -192,13 +194,20 @@ void RemoteSourceBufferProxy::sourceBufferPrivateBufferedDirtyChanged(bool flag)
     m_connectionToWebProcess->connection().send(Messages::SourceBufferPrivateRemote::SourceBufferPrivateBufferedDirtyChanged(flag), m_identifier);
 }
 
-void RemoteSourceBufferProxy::append(const SharedMemory::IPCHandle& bufferHandle)
+void RemoteSourceBufferProxy::append(IPC::SharedBufferReference&& buffer, CompletionHandler<void(SharedMemory::IPCHandle&&)>&& completionHandler)
 {
-    auto sharedMemory = SharedMemory::map(bufferHandle.handle, SharedMemory::Protection::ReadOnly);
+    SharedMemory::Handle handle;
+
+    auto invokeCallbackAtScopeExit = makeScopeExit([&] {
+        completionHandler(SharedMemory::IPCHandle { WTFMove(handle), buffer.size() });
+    });
+
+    auto sharedMemory = buffer.sharedCopy();
     if (!sharedMemory)
         return;
+    m_sourceBufferPrivate->append(sharedMemory->createSharedBuffer(buffer.size()));
 
-    m_sourceBufferPrivate->append(sharedMemory->createSharedBuffer(bufferHandle.dataSize));
+    sharedMemory->createHandle(handle, SharedMemory::Protection::ReadOnly);
 }
 
 void RemoteSourceBufferProxy::abort()

diff --git a/Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.h b/Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.h
@@ -43,6 +43,7 @@
 namespace IPC {
 class Connection;
 class Decoder;
+class SharedBufferReference;
 }
 
 namespace WebCore {
@@ -88,7 +89,7 @@ class RemoteSourceBufferProxy final
     void setActive(bool);
     void canSwitchToType(const WebCore::ContentType&, CompletionHandler<void(bool)>&&);
     void setMode(WebCore::SourceBufferAppendMode);
-    void append(const SharedMemory::IPCHandle&);
+    void append(IPC::SharedBufferReference&&, CompletionHandler<void(WebKit::SharedMemory::IPCHandle&&)>&&);
     void abort();
     void resetParserState();
     void removedFromMediaSource();

diff --git a/Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.messages.in b/Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.messages.in
@@ -29,7 +29,7 @@ messages -> RemoteSourceBufferProxy NotRefCounted {
     SetActive(bool active)
     CanSwitchToType(WebCore::ContentType contentType) -> (bool canSwitch) Synchronous
     SetMode(WebCore::SourceBufferAppendMode appendMode)
-    Append(WebKit::SharedMemory::IPCHandle data)
+    Append(IPC::SharedBufferReference data) -> (WebKit::SharedMemory::IPCHandle remoteData)
     Abort()
     ResetParserState()
     RemovedFromMediaSource()

diff --git a/Source/WebKit/Platform/IPC/SharedBufferReference.cpp b/Source/WebKit/Platform/IPC/SharedBufferReference.cpp
@@ -123,4 +123,11 @@ const uint8_t* SharedBufferReference::data() const
     return downcast<SharedBuffer>(m_buffer.get())->data();
 }
 
+RefPtr<WebKit::SharedMemory> SharedBufferReference::sharedCopy() const
+{
+    if (!m_size)
+        return nullptr;
+    return SharedMemory::copyBuffer(*unsafeBuffer());
+}
+
 } // namespace IPC
diff --git a/Source/WebKit/Platform/IPC/SharedBufferReference.h b/Source/WebKit/Platform/IPC/SharedBufferReference.h
@@ -33,10 +33,6 @@
 #include <WebCore/SharedBuffer.h>
 #include <optional>
 
-namespace WebKit {
-class SharedMemory;
-}
-
 namespace IPC {
 
 class Decoder;
@@ -76,6 +72,7 @@ class SharedBufferReference {
     // once it's deserialised over IPC.
     RefPtr<WebCore::SharedBuffer> unsafeBuffer() const;
     const uint8_t* data() const;
+    RefPtr<WebKit::SharedMemory> sharedCopy() const;
 
     void encode(Encoder&) const;
     static WARN_UNUSED_RETURN std::optional<SharedBufferReference> decode(Decoder&);

diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteMediaResourceProxy.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteMediaResourceProxy.cpp
@@ -30,7 +30,7 @@
 
 #include "DataReference.h"
 #include "RemoteMediaResourceManagerMessages.h"
-#include "SharedMemory.h"
+#include "SharedBufferReference.h"
 #include "WebCoreArgumentCoders.h"
 #include <wtf/CompletionHandler.h>
 
@@ -74,16 +74,11 @@ void RemoteMediaResourceProxy::dataSent(WebCore::PlatformMediaResource&, unsigne
 
 void RemoteMediaResourceProxy::dataReceived(WebCore::PlatformMediaResource&, const WebCore::SharedBuffer& buffer)
 {
-    SharedMemory::Handle handle;
-    {
-        auto sharedMemory = SharedMemory::copyBuffer(buffer);
-        if (!sharedMemory)
-            return;
-        sharedMemory->createHandle(handle, SharedMemory::Protection::ReadOnly);
-    }
-    // Take ownership of shared memory and mark it as media-related memory.
-    handle.takeOwnershipOfMemory(MemoryLedger::Media);
-    m_connection->send(Messages::RemoteMediaResourceManager::DataReceived(m_id, SharedMemory::IPCHandle { WTFMove(handle), buffer.size() }), 0);
+    m_connection->sendWithAsyncReply(Messages::RemoteMediaResourceManager::DataReceived(m_id, IPC::SharedBufferReference { buffer }), [] (auto&& bufferHandle) {
+        // Take ownership of shared memory and mark it as media-related memory.
+        if (!bufferHandle.handle.isNull())
+            bufferHandle.handle.takeOwnershipOfMemory(MemoryLedger::Media);
+    }, 0);
 }
 
 void RemoteMediaResourceProxy::accessControlCheckFailed(WebCore::PlatformMediaResource&, const WebCore::ResourceError& error)

diff --git a/Source/WebKit/WebProcess/GPU/media/SourceBufferPrivateRemote.cpp b/Source/WebKit/WebProcess/GPU/media/SourceBufferPrivateRemote.cpp
@@ -33,6 +33,7 @@
 #include "MediaPlayerPrivateRemote.h"
 #include "MediaSourcePrivateRemote.h"
 #include "RemoteSourceBufferProxyMessages.h"
+#include "SharedBufferReference.h"
 #include "SourceBufferPrivateRemoteMessages.h"
 #include <WebCore/PlatformTimeRanges.h>
 #include <WebCore/SourceBufferPrivateClient.h>
@@ -83,17 +84,11 @@ void SourceBufferPrivateRemote::append(Ref<SharedBuffer>&& data)
     if (!m_gpuProcessConnection)
         return;
 
-    SharedMemory::Handle handle;
-    {
-        auto sharedData = SharedMemory::copyBuffer(data);
-        if (!sharedData)
-            return;
-        sharedData->createHandle(handle, SharedMemory::Protection::ReadOnly);
-    }
-    // Take ownership of shared memory and mark it as media-related memory.
-    handle.takeOwnershipOfMemory(MemoryLedger::Media);
-
-    m_gpuProcessConnection->connection().send(Messages::RemoteSourceBufferProxy::Append(SharedMemory::IPCHandle { WTFMove(handle), data->size() }), m_remoteSourceBufferIdentifier);
+    m_gpuProcessConnection->connection().sendWithAsyncReply(Messages::RemoteSourceBufferProxy::Append(IPC::SharedBufferReference { WTFMove(data) }), [] (auto&& bufferHandle) {
+        // Take ownership of shared memory and mark it as media-related memory.
+        if (!bufferHandle.handle.isNull())
+            bufferHandle.handle.takeOwnershipOfMemory(MemoryLedger::Media);
+    }, m_remoteSourceBufferIdentifier);
 }
 
 void SourceBufferPrivateRemote::abort()