Bitmap transport

This patch reworks bitmap transport on all platforms. Linux and Mac
are switched from serialising bitmaps over the IPC channel to using
shared memory. All platforms gain a shared memory mapping cache on the
host side.

The concept of a TransportDIB (device independent bitmap) is added to
encapsulate most of the platform specifics.

On Linux, we use SysV shared memory. This is because X shared pixmaps,
which predate POSIX SHM, can only use SysV. By using SysV between
renderer and browser, we open up the possibility to map the shared
memory directly from the renderer to the X server.

On Mac, we use POSIX shared memory. However, since this needs
filesystem access and the Mac renderer is sandboxed from the
filesystem, we add two new messages from renderer -> browser:

The first, AllocTransportDIB, synchronously creates a transport DIB in
the browser and passes a handle back to the renderer. The second,
FreeTransportDIB, asynchronously, notifies the browser that it may
close its handle to the shared memory region.

On Mac, the shared memory regions are identified by their inode
numbers on the wire. This means that the browser must keep handles
open to all the allocated shared memory regions (since an inode number
is insufficient to map the region). The alternative design is that the
renderer passes the file descriptor with each paint operation. Since
passing file descriptors is special case in the code, I felt that it
would be best to minimise their use. Creating and freeing transport
DIBs are relatively rare operations relative to paints and scrolls.

On Windows, most of the code remains the same, except that Windows now
uses the mapping cache added in this patch. This allows the browser to
maintain a shared memory mapping for a transport DIB over several
paints. Previously it mapped and unmapped for every operation, causing
lots of TLB and VM churn.

Review URL: http://codereview.chromium.org/21485


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@10071 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 34 insertions, 1 deletions

diff --git a/chrome/browser/renderer_host/render_widget_helper.h b/chrome/browser/renderer_host/render_widget_helper.h
index 83cedb0..eb13ff0 100644
--- a/chrome/browser/renderer_host/render_widget_helper.h
+++ b/chrome/browser/renderer_host/render_widget_helper.h
@@ -1,4 +1,3 @@
-
 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
@@ -12,7 +11,9 @@
 #include "base/ref_counted.h"
 #include "base/lock.h"
 #include "base/waitable_event.h"
+#include "chrome/common/ipc_maybe.h"
 #include "chrome/common/modal_dialog_event.h"
+#include "chrome/common/transport_dib.h"
 
 namespace IPC {
 class Message;
@@ -74,6 +75,15 @@ class ResourceDispatcherHost;
 //   GetBackingStore method is called, it will call WaitForPaintMsg if it has
 //   no backingstore.
 //
+// TRANSPORT DIB CREATION
+//
+//   On some platforms (currently the Mac) the renderer cannot create transport
+//   DIBs because of sandbox limitations. Thus, it has to make synchronous IPCs
+//   to the browser for them. Since these requests are synchronous, they cannot
+//   terminate on the UI thread. Thus, in this case, this object performs the
+//   allocation and maintains the set of allocated transport DIBs which the
+//   renderers can refer to.
+//
 class RenderWidgetHelper :
     public base::RefCountedThreadSafe<RenderWidgetHelper> {
  public:
@@ -99,6 +109,11 @@ class RenderWidgetHelper :
                        const base::TimeDelta& max_delay,
                        IPC::Message* msg);
 
+#if defined(OS_MACOSX)
+  // Given the id of a transport DIB, return a mapping to it or NULL on error.
+  TransportDIB* MapTransportDIB(TransportDIB::Id dib_id);
+#endif
+
 
   // IO THREAD ONLY -----------------------------------------------------------
 
@@ -114,6 +129,14 @@ class RenderWidgetHelper :
                        ModalDialogEvent* modal_dialog_event);
   void CreateNewWidget(int opener_id, bool activatable, int* route_id);
 
+#if defined(OS_MACOSX)
+  // Called on the IO thread to handle the allocation of a transport DIB
+  void AllocTransportDIB(size_t size, IPC::Maybe<TransportDIB::Handle>* result);
+
+  // Called on the IO thread to handle the freeing of a transport DIB
+  void FreeTransportDIB(TransportDIB::Id dib_id);
+#endif
+
  private:
   // A class used to proxy a paint message.  PaintMsgProxy objects are created
   // on the IO thread and destroyed on the UI thread.
@@ -141,6 +164,16 @@ class RenderWidgetHelper :
                                int new_render_process_host_id,
                                int new_request_id);
 
+#if defined(OS_MACOSX)
+  // Called on destruction to release all allocated transport DIBs
+  void ClearAllocatedDIBs();
+
+  // On OSX we keep file descriptors to all the allocated DIBs around until
+  // the renderer frees them.
+  Lock allocated_dibs_lock_;
+  std::map<TransportDIB::Id, int> allocated_dibs_;
+#endif
+
   // A map of live paint messages.  Must hold pending_paints_lock_ to access.
   // The PaintMsgProxy objects are not owned by this map.  (See PaintMsgProxy
   // for details about how the lifetime of instances are managed.)