Add cc::Surface ref counting.

cc/surfaces/surface_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/surfaces/surface_manager.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
+#include <utility>
+
 #include "base/logging.h"
 #include "cc/surfaces/surface.h"
 #include "cc/surfaces/surface_factory_client.h"
 #include "cc/surfaces/surface_id_allocator.h"
 
 namespace cc {
+namespace {
+
+// Copies contents of |set| so we can iterate over them while removing entries
+// from |set| without worrying about iterator invalidation.
+std::vector<SurfaceId> CopySurfaceIds(const SurfaceManager::SurfaceIdSet& set) {
+  return std::vector<SurfaceId>(set.begin(), set.end());
+}
+
+}  // namespace
 
 SurfaceManager::FrameSinkSourceMapping::FrameSinkSourceMapping()
     : client(nullptr), source(nullptr) {}
 
 SurfaceManager::FrameSinkSourceMapping::FrameSinkSourceMapping(
     const FrameSinkSourceMapping& other) = default;
 
 SurfaceManager::FrameSinkSourceMapping::~FrameSinkSourceMapping() {
   DCHECK(is_empty()) << "client: " << client
                      << ", children: " << children.size();
@@ skipping 23 matching lines @@
   DCHECK(surface);
   DCHECK(!surface_map_.count(surface->surface_id()));
   surface_map_[surface->surface_id()] = surface;
 }
 
 void SurfaceManager::DeregisterSurface(const SurfaceId& surface_id) {
   DCHECK(thread_checker_.CalledOnValidThread());
   SurfaceMap::iterator it = surface_map_.find(surface_id);
   DCHECK(it != surface_map_.end());
   surface_map_.erase(it);
+  child_to_parent_refs_.erase(surface_id);
+  parent_to_child_refs_.erase(surface_id);
 }
 
 void SurfaceManager::Destroy(std::unique_ptr<Surface> surface) {
   DCHECK(thread_checker_.CalledOnValidThread());
   surface->set_destroyed(true);
   surfaces_to_destroy_.push_back(std::move(surface));
   GarbageCollectSurfaces();
 }
 
 void SurfaceManager::DidSatisfySequences(const FrameSinkId& frame_sink_id,
                                          std::vector<uint32_t>* sequence) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  for (std::vector<uint32_t>::iterator it = sequence->begin();
-       it != sequence->end();
-       ++it) {
-    satisfied_sequences_.insert(SurfaceSequence(frame_sink_id, *it));
+  for (uint32_t value : *sequence) {
+    satisfied_sequences_.insert(SurfaceSequence(frame_sink_id, value));
   }
   sequence->clear();
   GarbageCollectSurfaces();
 }
 
 void SurfaceManager::RegisterFrameSinkId(const FrameSinkId& frame_sink_id) {
   bool inserted = valid_frame_sink_ids_.insert(frame_sink_id).second;
   DCHECK(inserted);
 }
 
 void SurfaceManager::InvalidateFrameSinkId(const FrameSinkId& frame_sink_id) {
   valid_frame_sink_ids_.erase(frame_sink_id);
   GarbageCollectSurfaces();
 }
 
+void SurfaceManager::AddSurfaceIdReference(const SurfaceId& parent_id,
+                                           const SurfaceId& child_id) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  // This should never happen but we don't want to DHCECK if we get bad input
+  // from a compromised client.
+  if (parent_id == child_id) {
+    LOG(ERROR) << "Cannot add self reference for " << parent_id.ToString();
+    return;
+  }
+
+  parent_to_child_refs_[parent_id].insert(child_id);
+  child_to_parent_refs_[child_id].insert(parent_id);
+
+  DCHECK_EQ(parent_to_child_refs_[parent_id].count(child_id), 1u);
+  DCHECK_EQ(child_to_parent_refs_[child_id].count(parent_id), 1u);
+}
+
+void SurfaceManager::RemoveSurfaceIdReference(const SurfaceId& parent_id,
+                                              const SurfaceId& child_id,
+                                              bool should_run_gc) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  // If the GPU process crashes a client could try to free an invalid surface.
+  if (parent_to_child_refs_.count(parent_id) == 0 ||
+      parent_to_child_refs_[parent_id].count(child_id) == 0) {
+    LOG(ERROR) << "No reference from " << parent_id.ToString() << " to "
+               << child_id.ToString();
+    return;
+  }
+
+  // Remove the reference from parent to child. This doesn't change anything
+  // about the validity of the parent.
+  parent_to_child_refs_[parent_id].erase(child_id);
+
+  // Remove the reference from child to parent. This might drop the number of
+  // references to the child to zero.
+  DCHECK_EQ(child_to_parent_refs_.count(child_id), 1u);
+  SurfaceIdSet& child_refs = child_to_parent_refs_[child_id];
+  DCHECK_EQ(child_refs.count(parent_id), 1u);
+  child_refs.erase(parent_id);
+
+  if (!child_refs.empty())
+    return;
+
+  // Remove any references the child holds before it gets garbage collected.
+  for (auto& surface_id : CopySurfaceIds(parent_to_child_refs_[child_id]))
+    RemoveSurfaceIdReference(child_id, surface_id, false);
+  DCHECK_EQ(GetSurfaceRefereeCount(child_id), 0u);
+
+  if (should_run_gc)

[Fady Samuel, 2016/11/02 03:10:36]

nit: add a comment as to when you'd run gc?

+    GarbageCollectSurfaces();
+}
+
+void SurfaceManager::RemoveAllReferencesForFrameSink(
+    const FrameSinkId& frame_sink_id) {
+  // Find set of surfaces that belong to the FrameSink.
+  SurfaceIdSet frame_sink_surfaces;
+  for (auto& map_entry : parent_to_child_refs_) {
+    const SurfaceId& surface_id = map_entry.first;
+    if (surface_id.frame_sink_id() == frame_sink_id)
+      frame_sink_surfaces.insert(surface_id);
+  }
+  for (auto& map_entry : child_to_parent_refs_) {
+    const SurfaceId& surface_id = map_entry.first;
+    if (surface_id.frame_sink_id() == frame_sink_id)
+      frame_sink_surfaces.insert(surface_id);
+  }
+
+  // Clear all surface references belonging to FrameSink |frame_sink_id|.
+  for (const SurfaceId& surface_id : frame_sink_surfaces)
+    RemoveAllReferencesForSurfaceId(surface_id);
+}
+
+void SurfaceManager::RemoveAllReferencesForSurfaceId(
+    const SurfaceId& surface_id) {
+  // Remove any references from parents to this surface, since this surface
+  // no longer exists. This surface will have zero references when finished.
+  if (child_to_parent_refs_.count(surface_id) > 0) {
+    for (auto& parent_id : CopySurfaceIds(child_to_parent_refs_[surface_id]))
+      RemoveSurfaceIdReference(parent_id, surface_id);
+  }
+  DCHECK_EQ(GetSurfaceReferenceCount(surface_id), 0u);
+
+  // Remove any references from this surface to children, since this surface
+  // no longer exists. A child surface may drop to zero references here,
+  // recursively clearing any references the child surface holds.
+  if (parent_to_child_refs_.count(surface_id) > 0) {
+    for (auto& child_id : CopySurfaceIds(parent_to_child_refs_[surface_id]))
+      RemoveSurfaceIdReference(surface_id, child_id);
+  }
+  DCHECK_EQ(GetSurfaceRefereeCount(surface_id), 0u);
+}
+
+size_t SurfaceManager::GetSurfaceReferenceCount(
+    const SurfaceId& surface_id) const {
+  auto iter = child_to_parent_refs_.find(surface_id);
+  if (iter == child_to_parent_refs_.end())
+    return 0;
+  return iter->second.size();
+}
+
+size_t SurfaceManager::GetSurfaceRefereeCount(
+    const SurfaceId& surface_id) const {
+  auto iter = parent_to_child_refs_.find(surface_id);
+  if (iter == parent_to_child_refs_.end())
+    return 0;
+  return iter->second.size();
+}
+
 void SurfaceManager::GarbageCollectSurfaces() {
   // Simple mark and sweep GC.
   // TODO(jbauman): Reduce the amount of work when nothing needs to be
   // destroyed.
   std::vector<SurfaceId> live_surfaces;
-  std::set<SurfaceId> live_surfaces_set;
+  std::unordered_set<SurfaceId, SurfaceIdHash> live_surfaces_set;
 
   // GC roots are surfaces that have not been destroyed, or have not had all
   // their destruction dependencies satisfied.
   for (auto& map_entry : surface_map_) {
-    map_entry.second->SatisfyDestructionDependencies(&satisfied_sequences_,
-                                                     &valid_frame_sink_ids_);
-    if (!map_entry.second->destroyed() ||
-        map_entry.second->GetDestructionDependencyCount()) {
-      live_surfaces_set.insert(map_entry.first);
-      live_surfaces.push_back(map_entry.first);
+    const SurfaceId& surface_id = map_entry.first;
+    Surface* surface = map_entry.second;
+    surface->SatisfyDestructionDependencies(&satisfied_sequences_,
+                                            &valid_frame_sink_ids_);
+
+    // Never use both SurfaceSequence and Surface references.
+    DCHECK(surface->GetDestructionDependencyCount() == 0 ||
+           GetSurfaceReferenceCount(surface_id) == 0);
+
+    if (!surface->destroyed() || surface->GetDestructionDependencyCount() > 0 ||
+        GetSurfaceReferenceCount(surface_id) > 0) {
+      live_surfaces_set.insert(surface_id);
+      live_surfaces.push_back(surface_id);
     }
   }
 
   // Mark all surfaces reachable from live surfaces by adding them to
   // live_surfaces and live_surfaces_set.
   for (size_t i = 0; i < live_surfaces.size(); i++) {
     Surface* surf = surface_map_[live_surfaces[i]];
     DCHECK(surf);
 
     for (const SurfaceId& id : surf->referenced_surfaces()) {
       if (live_surfaces_set.count(id))
         continue;
 
       Surface* surf2 = GetSurfaceForId(id);
       if (surf2) {
         live_surfaces.push_back(id);
         live_surfaces_set.insert(id);
       }
     }
   }
 
   std::vector<std::unique_ptr<Surface>> to_destroy;
 
   // Destroy all remaining unreachable surfaces.
-  for (SurfaceDestroyList::iterator dest_it = surfaces_to_destroy_.begin();
-       dest_it != surfaces_to_destroy_.end();) {
-    if (!live_surfaces_set.count((*dest_it)->surface_id())) {
-      std::unique_ptr<Surface> surf(std::move(*dest_it));
-      DeregisterSurface(surf->surface_id());
-      dest_it = surfaces_to_destroy_.erase(dest_it);
-      to_destroy.push_back(std::move(surf));
+  for (auto iter = surfaces_to_destroy_.begin();
+       iter != surfaces_to_destroy_.end();) {
+    SurfaceId surface_id = (*iter)->surface_id();
+    if (!live_surfaces_set.count(surface_id)) {
+      DeregisterSurface(surface_id);
+      to_destroy.push_back(std::move(*iter));
+      iter = surfaces_to_destroy_.erase(iter);
+      LOG(ERROR) << "GC destroyed " << surface_id.ToString();
     } else {
-      ++dest_it;
+      ++iter;
     }
   }
 
   to_destroy.clear();
 }
 
 void SurfaceManager::RegisterSurfaceFactoryClient(
     const FrameSinkId& frame_sink_id,
     SurfaceFactoryClient* client) {
   DCHECK(client);
-  DCHECK(!frame_sink_source_map_[frame_sink_id].client);
   DCHECK_EQ(valid_frame_sink_ids_.count(frame_sink_id), 1u);
 
-  auto iter = frame_sink_source_map_.find(frame_sink_id);
-  if (iter == frame_sink_source_map_.end()) {
-    auto insert_result = frame_sink_source_map_.insert(
-        std::make_pair(frame_sink_id, FrameSinkSourceMapping()));
-    DCHECK(insert_result.second);
-    iter = insert_result.first;
-  }
-  iter->second.client = client;
+  // Will create a new FrameSinkSourceMapping for |frame_sink_id| if necessary.
+  FrameSinkSourceMapping& frame_sink_source =
+      frame_sink_source_map_[frame_sink_id];
+  DCHECK(!frame_sink_source.client);
+  frame_sink_source.client = client;
 
   // Propagate any previously set sources to the new client.
-  if (iter->second.source)
-    client->SetBeginFrameSource(iter->second.source);
+  if (frame_sink_source.source)
+    client->SetBeginFrameSource(frame_sink_source.source);
 }
 
 void SurfaceManager::UnregisterSurfaceFactoryClient(
     const FrameSinkId& frame_sink_id) {
   DCHECK_EQ(valid_frame_sink_ids_.count(frame_sink_id), 1u);
   DCHECK_EQ(frame_sink_source_map_.count(frame_sink_id), 1u);
 
+  RemoveAllReferencesForFrameSink(frame_sink_id);
+
   auto iter = frame_sink_source_map_.find(frame_sink_id);
   if (iter->second.source)
     iter->second.client->SetBeginFrameSource(nullptr);
   iter->second.client = nullptr;
 
   // The SurfaceFactoryClient and hierarchy can be registered/unregistered
   // in either order, so empty namespace_client_map entries need to be
   // checked when removing either clients or relationships.
   if (iter->second.is_empty())
     frame_sink_source_map_.erase(iter);
@@ skipping 150 matching lines @@
   // TODO(enne): these walks could be done in one step.
   RecursivelyDetachBeginFrameSource(child_frame_sink_id, parent_source);
   for (auto source_iter : registered_sources_)
     RecursivelyAttachBeginFrameSource(source_iter.second, source_iter.first);
 }
 
 Surface* SurfaceManager::GetSurfaceForId(const SurfaceId& surface_id) {
   DCHECK(thread_checker_.CalledOnValidThread());
   SurfaceMap::iterator it = surface_map_.find(surface_id);
   if (it == surface_map_.end())
-    return NULL;
+    return nullptr;
   return it->second;
 }
 
 bool SurfaceManager::SurfaceModified(const SurfaceId& surface_id) {
   CHECK(thread_checker_.CalledOnValidThread());
   bool changed = false;
   for (auto& observer : observer_list_)
     observer.OnSurfaceDamaged(surface_id, &changed);
   return changed;
 }
 
 void SurfaceManager::SurfaceCreated(const SurfaceId& surface_id,
                                     const gfx::Size& frame_size,
                                     float device_scale_factor) {
   CHECK(thread_checker_.CalledOnValidThread());
   for (auto& observer : observer_list_)
     observer.OnSurfaceCreated(surface_id, frame_size, device_scale_factor);
 }
 
 }  // namespace cc