Send FrameSwapMessageQueue's messages with a separate IPC

content/browser/renderer_host/render_widget_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 
 #include <math.h>
 
 #include <set>
 #include <tuple>
@@ skipping 556 matching lines @@
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowDisambiguationPopup,
                         OnShowDisambiguationPopup)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SelectionBoundsChanged,
                         OnSelectionBoundsChanged)
     IPC_MESSAGE_HANDLER(InputHostMsg_ImeCompositionRangeChanged,
                         OnImeCompositionRangeChanged)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SetNeedsBeginFrames, OnSetNeedsBeginFrames)
     IPC_MESSAGE_HANDLER(ViewHostMsg_FocusedNodeTouched, OnFocusedNodeTouched)
     IPC_MESSAGE_HANDLER(DragHostMsg_StartDragging, OnStartDragging)
     IPC_MESSAGE_HANDLER(DragHostMsg_UpdateDragCursor, OnUpdateDragCursor)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_FrameSwapMessages,
+                        OnFrameSwapMessagesReceived)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
   if (!handled && input_router_ && input_router_->OnMessageReceived(msg))
     return true;
 
   if (!handled && view_ && view_->OnMessageReceived(msg))
     return true;
 
   return handled;
@@ skipping 982 matching lines @@
 
 void RenderWidgetHostImpl::OnUpdateDragCursor(WebDragOperation current_op) {
   if (delegate_ && delegate_->OnUpdateDragCursor())
     return;
 
   RenderViewHostDelegateView* view = delegate_->GetDelegateView();
   if (view)
     view->UpdateDragCursor(current_op);
 }
 
+void RenderWidgetHostImpl::OnFrameSwapMessagesReceived(
+    uint32_t frame_token,
+    std::vector<IPC::Message> messages) {
+  // Zero token is invalid.
+  if (!frame_token) {
+    bad_message::ReceivedBadMessage(GetProcess(),
+                                    bad_message::RWH_INVALID_FRAME_TOKEN);
+    return;
+  }
+
+  // Frame tokens always increase.
+  if (queued_messages_.size() && frame_token <= queued_messages_.back().first) {
+    bad_message::ReceivedBadMessage(GetProcess(),
+                                    bad_message::RWH_INVALID_FRAME_TOKEN);
+    return;
+  }
+
+  if (frame_token <= last_received_frame_token_) {
+    ProcessSwapMessages(std::move(messages));
+    return;
+  }
+
+  queued_messages_.push(std::make_pair(frame_token, std::move(messages)));
+}
+
 void RenderWidgetHostImpl::RendererExited(base::TerminationStatus status,
                                           int exit_code) {
   if (!renderer_initialized_)
     return;
 
   // Clear this flag so that we can ask the next renderer for composition
   // updates.
   monitoring_composition_info_ = false;
 
   // Clearing this flag causes us to re-create the renderer when recovering
@@ skipping 32 matching lines @@
   }
 
   // Reconstruct the input router to ensure that it has fresh state for a new
   // renderer. Otherwise it may be stuck waiting for the old renderer to ack an
   // event. (In particular, the above call to view_->RenderProcessGone will
   // destroy the aura window, which may dispatch a synthetic mouse move.)
   input_router_.reset(new InputRouterImpl(
       process_, this, this, routing_id_, GetInputRouterConfigForPlatform()));
 
   synthetic_gesture_controller_.reset();
+
+  last_received_frame_token_ = 0;
+  while (queued_messages_.size()) {
+    ProcessSwapMessages(std::move(queued_messages_.front().second));

[Saman Sami, 2017/04/04 19:43:12]

OK, maybe this is not a good idea. Maybe it's better not to process messages
coming from a renderer that has exited, because it's kind of equivalent to
receiving messages from a dead process. This might leave the recipient of these
messages in a bad state for example. Please correct me if I'm wrong.

[piman, 2017/04/04 19:49:49]

Recipients have to deal with render process dying and never giving them these
messages today, so I think it's ok to not process the message (i.e. today it
would be equivalent to never receiving the frame).

It's also probably ok to process them, if done at the right place (maybe earlier
in this function), but I think you're right that not doing so is safer.

+    queued_messages_.pop();
+  }
 }
 
 void RenderWidgetHostImpl::UpdateTextDirection(WebTextDirection direction) {
   text_direction_updated_ = true;
   text_direction_ = direction;
 }
 
 void RenderWidgetHostImpl::CancelUpdateTextDirection() {
   if (text_direction_updated_)
     text_direction_canceled_ = true;
@@ skipping 201 matching lines @@
   // This trace event is used in
   // chrome/browser/extensions/api/cast_streaming/performance_test.cc
   TRACE_EVENT0("test_fps,benchmark", "OnSwapCompositorFrame");
 
   ViewHostMsg_SwapCompositorFrame::Param param;
   if (!ViewHostMsg_SwapCompositorFrame::Read(&message, &param))
     return false;
   uint32_t compositor_frame_sink_id = std::get<0>(param);
   cc::LocalSurfaceId local_surface_id = std::get<1>(param);
   cc::CompositorFrame frame(std::move(std::get<2>(param)));
-  std::vector<IPC::Message> messages_to_deliver_with_frame;
-  messages_to_deliver_with_frame.swap(std::get<3>(param));
 
   if (compositor_frame_sink_id != last_compositor_frame_sink_id_) {
     if (view_)
       view_->DidCreateNewRendererCompositorFrameSink();
     last_compositor_frame_sink_id_ = compositor_frame_sink_id;
   }
 
   SubmitCompositorFrame(local_surface_id, std::move(frame));
 
-  RenderProcessHost* rph = GetProcess();
-  for (std::vector<IPC::Message>::const_iterator i =
-           messages_to_deliver_with_frame.begin();
-       i != messages_to_deliver_with_frame.end();
-       ++i) {
-    rph->OnMessageReceived(*i);
-    if (i->dispatch_error())
-      rph->OnBadMessageReceived(*i);
-  }
-  messages_to_deliver_with_frame.clear();
-
   return true;
 }
 
 void RenderWidgetHostImpl::OnBeginFrameDidNotSwap(
     const cc::BeginFrameAck& ack) {
   if (ack.sequence_number < cc::BeginFrameArgs::kStartingFrameNumber) {
     // Received an invalid ack, renderer misbehaved.
     bad_message::ReceivedBadMessage(
         GetProcess(), bad_message::RWH_INVALID_BEGIN_FRAME_ACK_DID_NOT_SWAP);
     return;
@@ skipping 718 matching lines @@
       (frame_size != last_frame_size_ ||
        device_scale_factor != last_device_scale_factor_)) {
     DLOG(ERROR) << "Renderer submitted frame of wrong size to its surface."
                 << " Expected: size=" << last_frame_size_.ToString()
                 << ",scale=" << last_device_scale_factor_
                 << " Received: size=" << frame_size.ToString()
                 << ",scale=" << device_scale_factor;
     return;
   }
 
+  uint32_t frame_token = frame.metadata.frame_token;
+
   last_local_surface_id_ = local_surface_id;
   last_frame_size_ = frame_size;
   last_device_scale_factor_ = device_scale_factor;
 
   last_received_content_source_id_ = frame.metadata.content_source_id;
 
   if (frame.metadata.begin_frame_ack.sequence_number <
       cc::BeginFrameArgs::kStartingFrameNumber) {
     // Received an invalid ack, renderer misbehaved.
     bad_message::ReceivedBadMessage(
@@ skipping 30 matching lines @@
     cc::TransferableResource::ReturnResources(frame.resource_list, &resources);
     SendReclaimCompositorResources(true /* is_swap_ack */, resources);
   }
 
   // After navigation, if a frame belonging to the new page is received, stop
   // the timer that triggers clearing the graphics of the last page.
   if (last_received_content_source_id_ >= current_content_source_id_ &&
       new_content_rendering_timeout_->IsRunning()) {
     new_content_rendering_timeout_->Stop();
   }
+
+  if (frame_token)
+    DidProcessFrame(frame_token);
+}
+
+void RenderWidgetHostImpl::DidProcessFrame(uint32_t frame_token) {
+  // Frame tokens always increase.
+  if (frame_token <= last_received_frame_token_) {
+    bad_message::ReceivedBadMessage(GetProcess(),
+                                    bad_message::RWH_INVALID_FRAME_TOKEN);
+    return;
+  }
+
+  last_received_frame_token_ = frame_token;
+
+  while (queued_messages_.size() &&
+         queued_messages_.front().first <= frame_token) {
+    ProcessSwapMessages(std::move(queued_messages_.front().second));
+    queued_messages_.pop();
+  }
+}
+
+void RenderWidgetHostImpl::ProcessSwapMessages(
+    std::vector<IPC::Message> messages) {
+  RenderProcessHost* rph = GetProcess();
+  for (std::vector<IPC::Message>::const_iterator i = messages.begin();
+       i != messages.end(); ++i) {
+    rph->OnMessageReceived(*i);
+    if (i->dispatch_error())
+      rph->OnBadMessageReceived(*i);
+  }
 }
 
 }  // namespace content