Split GpuProcessHost into GpuProcessHostUIShim, which runs on the UI

thread, and GpuProcessHost, which now runs on the IO thread and
derives from ChildProcessHost. This split was necessary in order to
service synchronous messages from the renderer process. Moved message
handlers for GPU messages from renderer to browser from
BrowserRenderProcessHost to ResourceMessageFilter.

Stopped sending multiple ViewHostMsg_EstablishGpuChannel messages from
the same renderer if the connection was already established. Resetting
the channel was causing failures in Send, and every other page reload
containing WebGL content to fail. This cleanup will allow further
simplification in the GPU process, but this is being left for a
subsequent CL.

Fixed bug in sandboxing of GPU process. Fixed latent bugs in cleanup
code in GpuChannel and GpuChannelHost. Fixed crashes in
ChildProcessHost if resource_dispatcher_host_ was NULL. Fixed apparent
latent race conditions in creation of BackingStoreProxy and
VideoLayerProxy.

With these changes, WebGL content is running in the sandbox on both
Mac and Windows. Linux support will be added in a following CL.

BUG=29120
TEST=ran WebGL demos on Mac and Windows

Review URL: http://codereview.chromium.org/1546001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@43029 0039d316-1c4b-4281-b951-d872f2087c98

10 files changed, 64 insertions, 57 deletions

diff --git a/chrome/browser/renderer_host/backing_store_proxy.cc b/chrome/browser/renderer_host/backing_store_proxy.cc
index c41900d..ba3538b 100644
--- a/chrome/browser/renderer_host/backing_store_proxy.cc
+++ b/chrome/browser/renderer_host/backing_store_proxy.cc
@@ -5,7 +5,7 @@
 #include "chrome/browser/renderer_host/backing_store_proxy.h"
 
 #include "build/build_config.h"
-#include "chrome/browser/gpu_process_host.h"
+#include "chrome/browser/gpu_process_host_ui_shim.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/render_widget_host.h"
 #include "chrome/common/gpu_messages.h"
@@ -18,17 +18,17 @@
 
 BackingStoreProxy::BackingStoreProxy(RenderWidgetHost* widget,
                                      const gfx::Size& size,
-                                     GpuProcessHost* process,
+                                     GpuProcessHostUIShim* process_shim,
                                      int32 routing_id)
     : BackingStore(widget, size),
-      process_(process),
+      process_shim_(process_shim),
       routing_id_(routing_id),
       waiting_for_paint_ack_(false) {
-  process_->AddRoute(routing_id_, this);
+  process_shim_->AddRoute(routing_id_, this);
 }
 
 BackingStoreProxy::~BackingStoreProxy() {
-  process_->RemoveRoute(routing_id_);
+  process_shim_->RemoveRoute(routing_id_);
 }
 
 void BackingStoreProxy::PaintToBackingStore(
@@ -46,7 +46,7 @@ void BackingStoreProxy::PaintToBackingStore(
   process_id = process->GetHandle();
 #endif
 
-  if (process_->Send(new GpuMsg_PaintToBackingStore(
+  if (process_shim_->Send(new GpuMsg_PaintToBackingStore(
           routing_id_, process_id, bitmap, bitmap_rect, copy_rects))) {
     // Message sent successfully, so the caller can not destroy the
     // TransportDIB. OnDonePaintingToBackingStore will free it later.
@@ -67,8 +67,8 @@ bool BackingStoreProxy::CopyFromBackingStore(const gfx::Rect& rect,
 void BackingStoreProxy::ScrollBackingStore(int dx, int dy,
                                            const gfx::Rect& clip_rect,
                                            const gfx::Size& view_size) {
-  process_->Send(new GpuMsg_ScrollBackingStore(routing_id_, dx, dy,
-                                               clip_rect, view_size));
+  process_shim_->Send(new GpuMsg_ScrollBackingStore(routing_id_, dx, dy,
+                                                    clip_rect, view_size));
 }
 
 void BackingStoreProxy::OnMessageReceived(const IPC::Message& msg) {
diff --git a/chrome/browser/renderer_host/backing_store_proxy.h b/chrome/browser/renderer_host/backing_store_proxy.h
index 0b5059f..4d572b6 100644
--- a/chrome/browser/renderer_host/backing_store_proxy.h
+++ b/chrome/browser/renderer_host/backing_store_proxy.h
@@ -9,13 +9,13 @@
 #include "chrome/browser/renderer_host/backing_store.h"
 #include "ipc/ipc_channel.h"
 
-class GpuProcessHost;
+class GpuProcessHostUIShim;
 
 class BackingStoreProxy : public BackingStore,
                           public IPC::Channel::Listener {
  public:
   BackingStoreProxy(RenderWidgetHost* widget, const gfx::Size& size,
-                    GpuProcessHost* process, int32 routing_id);
+                    GpuProcessHostUIShim* process_shim, int32 routing_id);
   virtual ~BackingStoreProxy();
 
   // BackingStore implementation.
@@ -39,7 +39,7 @@ class BackingStoreProxy : public BackingStore,
   // Message handlers.
   void OnPaintToBackingStoreACK();
 
-  GpuProcessHost* process_;
+  GpuProcessHostUIShim* process_shim_;
   int32 routing_id_;
 
   // Set to true when we're waiting for the GPU process to do a paint and send
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index 7f72a79..15517fc 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -773,10 +773,6 @@ void BrowserRenderProcessHost::OnMessageReceived(const IPC::Message& msg) {
                           OnExtensionRemoveListener)
       IPC_MESSAGE_HANDLER(ViewHostMsg_ExtensionCloseChannel,
                           OnExtensionCloseChannel)
-      IPC_MESSAGE_HANDLER(ViewHostMsg_EstablishGpuChannel,
-                          OnMsgEstablishGpuChannel)
-      IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_SynchronizeGpu,
-                                      OnMsgSynchronizeGpu)
       IPC_MESSAGE_HANDLER(ViewHostMsg_SpellChecker_RequestDictionary,
                           OnSpellCheckerRequestDictionary)
       IPC_MESSAGE_UNHANDLED_ERROR()
@@ -981,14 +977,6 @@ void BrowserRenderProcessHost::OnExtensionCloseChannel(int port_id) {
   }
 }
 
-void BrowserRenderProcessHost::OnMsgEstablishGpuChannel() {
-  GpuProcessHost::Get()->EstablishGpuChannel(id());
-}
-
-void BrowserRenderProcessHost::OnMsgSynchronizeGpu(IPC::Message* reply) {
-  GpuProcessHost::Get()->Synchronize(id(), reply);
-}
-
 void BrowserRenderProcessHost::OnSpellCheckerRequestDictionary() {
   if (profile()->GetSpellCheckHost()) {
     // The spellchecker initialization already started and finished; just send
diff --git a/chrome/browser/renderer_host/browser_render_process_host.h b/chrome/browser/renderer_host/browser_render_process_host.h
index 9a9c833..277a53e 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.h
+++ b/chrome/browser/renderer_host/browser_render_process_host.h
@@ -110,12 +110,6 @@ class BrowserRenderProcessHost : public RenderProcessHost,
   void OnExtensionAddListener(const std::string& event_name);
   void OnExtensionRemoveListener(const std::string& event_name);
   void OnExtensionCloseChannel(int port_id);
-  // Renderer process is requesting that the browser process establish a GPU
-  // channel.
-  void OnMsgEstablishGpuChannel();
-  // Renderer process is requesting that outstanding asynchronous GPU-related
-  // messages are processed.
-  void OnMsgSynchronizeGpu(IPC::Message* reply);
 
   // Initialize support for visited links. Send the renderer process its initial
   // set of visited links.
diff --git a/chrome/browser/renderer_host/gpu_view_host.cc b/chrome/browser/renderer_host/gpu_view_host.cc
index a81db6b..fa8c19c 100644
--- a/chrome/browser/renderer_host/gpu_view_host.cc
+++ b/chrome/browser/renderer_host/gpu_view_host.cc
@@ -4,43 +4,47 @@
 
 #include "chrome/browser/renderer_host/gpu_view_host.h"
 
-#include "chrome/browser/gpu_process_host.h"
+#include "chrome/browser/gpu_process_host_ui_shim.h"
 #include "chrome/browser/renderer_host/backing_store_proxy.h"
 #include "chrome/browser/renderer_host/video_layer_proxy.h"
 #include "chrome/common/gpu_messages.h"
 
 GpuViewHost::GpuViewHost(RenderWidgetHost* widget, GpuNativeWindowHandle parent)
     : widget_(widget),
-      process_(GpuProcessHost::Get()),
+      process_shim_(GpuProcessHostUIShim::Get()),
       routing_id_(0) {
-  if (!process_) {
+  if (!process_shim_) {
     // TODO(brettw) handle error.
     return;
   }
-  routing_id_ = process_->NewRenderWidgetHostView(parent);
+  routing_id_ = process_shim_->NewRenderWidgetHostView(parent);
 }
 
 GpuViewHost::~GpuViewHost() {
 }
 
 BackingStore* GpuViewHost::CreateBackingStore(const gfx::Size& size) {
-  int32 backing_store_routing_id = process_->GetNextRoutingId();
-  process_->Send(new GpuMsg_NewBackingStore(routing_id_,
-                                            backing_store_routing_id,
-                                            size));
-  return new BackingStoreProxy(widget_, size,
-                               process_, backing_store_routing_id);
+  int32 backing_store_routing_id = process_shim_->GetNextRoutingId();
+  BackingStoreProxy* result =
+      new BackingStoreProxy(widget_, size,
+                            process_shim_, backing_store_routing_id);
+  process_shim_->Send(new GpuMsg_NewBackingStore(routing_id_,
+                                                 backing_store_routing_id,
+                                                 size));
+  return result;
 }
 
 VideoLayer* GpuViewHost::CreateVideoLayer(const gfx::Size& size) {
-  int32 video_layer_routing_id = process_->GetNextRoutingId();
-  process_->Send(new GpuMsg_NewVideoLayer(routing_id_,
-                                          video_layer_routing_id,
-                                          size));
-  return new VideoLayerProxy(widget_, size,
-                             process_, video_layer_routing_id);
+  int32 video_layer_routing_id = process_shim_->GetNextRoutingId();
+  VideoLayerProxy* result =
+      new VideoLayerProxy(widget_, size,
+                          process_shim_, video_layer_routing_id);
+  process_shim_->Send(new GpuMsg_NewVideoLayer(routing_id_,
+                                               video_layer_routing_id,
+                                               size));
+  return result;
 }
 
 void GpuViewHost::OnWindowPainted() {
-  process_->Send(new GpuMsg_WindowPainted(routing_id_));
+  process_shim_->Send(new GpuMsg_WindowPainted(routing_id_));
 }
diff --git a/chrome/browser/renderer_host/gpu_view_host.h b/chrome/browser/renderer_host/gpu_view_host.h
index 910c978..8d19e07 100644
--- a/chrome/browser/renderer_host/gpu_view_host.h
+++ b/chrome/browser/renderer_host/gpu_view_host.h
@@ -9,7 +9,7 @@
 #include "chrome/common/gpu_native_window_handle.h"
 
 class BackingStore;
-class GpuProcessHost;
+class GpuProcessHostUIShim;
 class RenderWidgetHost;
 class VideoLayer;
 
@@ -40,7 +40,7 @@ class GpuViewHost {
  private:
   RenderWidgetHost* widget_;
 
-  GpuProcessHost* process_;
+  GpuProcessHostUIShim* process_shim_;
   int32 routing_id_;
 
   DISALLOW_COPY_AND_ASSIGN(GpuViewHost);
diff --git a/chrome/browser/renderer_host/resource_message_filter.cc b/chrome/browser/renderer_host/resource_message_filter.cc
index de9e836..3dfcf63 100644
--- a/chrome/browser/renderer_host/resource_message_filter.cc
+++ b/chrome/browser/renderer_host/resource_message_filter.cc
@@ -20,6 +20,7 @@
 #include "chrome/browser/extensions/extension_message_service.h"
 #include "chrome/browser/geolocation/geolocation_permission_context.h"
 #include "chrome/browser/geolocation/geolocation_dispatcher_host.h"
+#include "chrome/browser/gpu_process_host.h"
 #include "chrome/browser/host_zoom_map.h"
 #include "chrome/browser/in_process_webkit/dom_storage_dispatcher_host.h"
 #include "chrome/browser/metrics/histogram_synchronizer.h"
@@ -540,6 +541,10 @@ bool ResourceMessageFilter::OnMessageReceived(const IPC::Message& msg) {
 #if defined(USE_TCMALLOC)
       IPC_MESSAGE_HANDLER(ViewHostMsg_RendererTcmalloc, OnRendererTcmalloc)
 #endif
+      IPC_MESSAGE_HANDLER(ViewHostMsg_EstablishGpuChannel,
+                          OnEstablishGpuChannel)
+      IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_SynchronizeGpu,
+                                      OnSynchronizeGpu)
       IPC_MESSAGE_UNHANDLED(
           handled = false)
     IPC_END_MESSAGE_MAP_EX()
@@ -1411,6 +1416,19 @@ void ResourceMessageFilter::OnRendererTcmalloc(base::ProcessId pid,
 }
 #endif
 
+void ResourceMessageFilter::OnEstablishGpuChannel() {
+  GpuProcessHost::Get()->EstablishGpuChannel(id(), this);
+}
+
+void ResourceMessageFilter::OnSynchronizeGpu(IPC::Message* reply) {
+  // We handle this message (and the other GPU process messages) here
+  // rather than handing the message to the GpuProcessHost for
+  // dispatch so that we can use the DELAY_REPLY macro to synthesize
+  // the reply message, and also send down a "this" pointer so that
+  // the GPU process host can send the reply later.
+  GpuProcessHost::Get()->Synchronize(reply, this);
+}
+
 void ResourceMessageFilter::OnGetExtensionMessageBundle(
     const std::string& extension_id, IPC::Message* reply_msg) {
   ChromeURLRequestContext* context = static_cast<ChromeURLRequestContext*>(
diff --git a/chrome/browser/renderer_host/resource_message_filter.h b/chrome/browser/renderer_host/resource_message_filter.h
index 2abc4c0..a69fd78 100644
--- a/chrome/browser/renderer_host/resource_message_filter.h
+++ b/chrome/browser/renderer_host/resource_message_filter.h
@@ -328,6 +328,9 @@ class ResourceMessageFilter : public IPC::ChannelProxy::MessageFilter,
 
   void OnTranslateText(ViewHostMsg_TranslateTextParam param);
 
+  void OnEstablishGpuChannel();
+  void OnSynchronizeGpu(IPC::Message* reply);
+
 #if defined(USE_X11)
   void SendDelayedReply(IPC::Message* reply_msg);
   void DoOnGetScreenInfo(gfx::NativeViewId view, IPC::Message* reply_msg);
diff --git a/chrome/browser/renderer_host/video_layer_proxy.cc b/chrome/browser/renderer_host/video_layer_proxy.cc
index 1fdae24..3df1d25 100644
--- a/chrome/browser/renderer_host/video_layer_proxy.cc
+++ b/chrome/browser/renderer_host/video_layer_proxy.cc
@@ -4,23 +4,23 @@
 
 #include "chrome/browser/renderer_host/video_layer_proxy.h"
 
-#include "chrome/browser/gpu_process_host.h"
+#include "chrome/browser/gpu_process_host_ui_shim.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/common/gpu_messages.h"
 #include "gfx/rect.h"
 
 VideoLayerProxy::VideoLayerProxy(RenderWidgetHost* widget,
                                  const gfx::Size& size,
-                                 GpuProcessHost* process,
+                                 GpuProcessHostUIShim* process_shim,
                                  int32 routing_id)
     : VideoLayer(widget, size),
-      process_(process),
+      process_shim_(process_shim),
       routing_id_(routing_id) {
-  process_->AddRoute(routing_id_, this);
+  process_shim_->AddRoute(routing_id_, this);
 }
 
 VideoLayerProxy::~VideoLayerProxy() {
-  process_->RemoveRoute(routing_id_);
+  process_shim_->RemoveRoute(routing_id_);
 }
 
 void VideoLayerProxy::CopyTransportDIB(RenderProcessHost* process,
@@ -33,7 +33,7 @@ void VideoLayerProxy::CopyTransportDIB(RenderProcessHost* process,
   process_id = process->GetHandle();
 #endif
 
-  if (process_->Send(new GpuMsg_PaintToVideoLayer(
+  if (process_shim_->Send(new GpuMsg_PaintToVideoLayer(
           routing_id_, process_id, bitmap, bitmap_rect))) {
   } else {
     // TODO(scherkus): what to do ?!?!
diff --git a/chrome/browser/renderer_host/video_layer_proxy.h b/chrome/browser/renderer_host/video_layer_proxy.h
index 637525e..02b90ed 100644
--- a/chrome/browser/renderer_host/video_layer_proxy.h
+++ b/chrome/browser/renderer_host/video_layer_proxy.h
@@ -8,13 +8,13 @@
 #include "chrome/browser/renderer_host/video_layer.h"
 #include "ipc/ipc_channel.h"
 
-class GpuProcessHost;
+class GpuProcessHostUIShim;
 
 // Proxies YUV video layer data to the GPU process for rendering.
 class VideoLayerProxy : public VideoLayer, public IPC::Channel::Listener {
  public:
   VideoLayerProxy(RenderWidgetHost* widget, const gfx::Size& size,
-                  GpuProcessHost* process, int32 routing_id);
+                  GpuProcessHostUIShim* process_shim, int32 routing_id);
   virtual ~VideoLayerProxy();
 
   // VideoLayer implementation.
@@ -32,7 +32,7 @@ class VideoLayerProxy : public VideoLayer, public IPC::Channel::Listener {
   void OnPaintToVideoLayerACK();
 
   // GPU process receiving our proxied requests.
-  GpuProcessHost* process_;
+  GpuProcessHostUIShim* process_shim_;
 
   // IPC routing ID to use when communicating with the GPU process.
   int32 routing_id_;