tree 8e856a1c5652187c5a2d77a26701ec983e307f1a
parent ee12317405327b31b6fd139776e872b94d3ed8f7
author timothy_horton@apple.com <timothy_horton@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1606882991 +0000
committer timothy_horton@apple.com <timothy_horton@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1606882991 +0000

GPU Process: IOSurfaces should not be mapped into the Web Content Process
https://bugs.webkit.org/show_bug.cgi?id=219368

Reviewed by Said Abou-Hallawa.

Source/WebCore:

* platform/graphics/ConcreteImageBuffer.h:
* platform/graphics/ImageBuffer.h:
* platform/graphics/ImageBufferBackend.h:
* platform/graphics/cg/ImageBufferIOSurfaceBackend.h:
Make it possible to determine if an image buffer's backend is capable of mapping the backing store in-process or not.

Source/WebKit:

Since the Web Content process sandbox will eventually not have access to IOKit,
it will not be able to map/lock/use IOSurfaces. Thankfully, all it really needs
to be able to do is carry a reference to the surface from the GPU process to the
UI process (where it is mapped and applied as layer contents).

* GPUProcess/graphics/PlatformRemoteImageBuffer.h:
* Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::encode const):
(WebKit::RemoteLayerBackingStore::swapToValidFrontBuffer):
* SourcesCocoa.txt:
* WebKit.xcodeproj/project.pbxproj:
* WebProcess/GPU/graphics/PlatformImageBufferShareableBackend.h:
* WebProcess/GPU/graphics/PlatformRemoteImageBufferProxy.h:
(isType):
* WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::reestablishGPUProcessConnection):
(WebKit::RemoteRenderingBackendProxy::createImageBuffer):
(WebKit::RemoteRenderingBackendProxy::imageBufferBackendWasCreated):
(WebKit::RemoteRenderingBackendProxy::didFlush):

* WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp:
(WebKit::ImageBufferShareableIOSurfaceBackend::create):
(WebKit::ImageBufferShareableIOSurfaceBackend::createImageBufferBackendHandle const):
(WebKit::ImageBufferShareableIOSurfaceBackend::context const):
(WebKit::ImageBufferShareableIOSurfaceBackend::copyNativeImage const):
(WebKit::ImageBufferShareableIOSurfaceBackend::copyImage const):
(WebKit::ImageBufferShareableIOSurfaceBackend::draw):
(WebKit::ImageBufferShareableIOSurfaceBackend::drawPattern):
(WebKit::ImageBufferShareableIOSurfaceBackend::toDataURL const):
(WebKit::ImageBufferShareableIOSurfaceBackend::toData const):
(WebKit::ImageBufferShareableIOSurfaceBackend::toBGRAData const):
(WebKit::ImageBufferShareableIOSurfaceBackend::getImageData const):
(WebKit::ImageBufferShareableIOSurfaceBackend::putImageData):
* WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h:
* WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp: Copied from Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.cpp.
(WebKit::ImageBufferShareableMappedIOSurfaceBackend::create):
(WebKit::ImageBufferShareableMappedIOSurfaceBackend::createImageBufferBackendHandle const):
* WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.h: Copied from Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableIOSurfaceBackend.h.
Rename ImageBufferShareableIOSurfaceBackend to ImageBufferShareableMappedIOSurfaceBackend.
Readd ImageBufferShareableIOSurfaceBackend, the unmapped variant. The mapped variant is only used:
- in the GPU process
- in the Web Content process when DOM rendering in the GPU process is disabled

The unmapped variant cannot perform most ImageBufferBackend duties, except creating an ImageBufferBackendHandle,
which it does by cloning the existing handle. It explicitly does *not* map the IOSurface in the
process, and is meant for use in Web Content processes that do not have access to IOSurface.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@270342 268f45cc-cd09-0410-ab3c-d52691b4dbfc