Changeset 118627 in webkit

Timestamp:

May 27, 2012, 7:54:52 AM (14 years ago)

Author:

commit-queue@webkit.org

Message:

[BlackBerry] Crash when deleting WebPageCompositor
​https://bugs.webkit.org/show_bug.cgi?id=87589

Patch by Arvid Nilsson <​anilsson@rim.com> on 2012-05-27
Reviewed by Rob Buis.

The WebPageCompositorPrivate is reference counted, so it may outlive
either the WebPage or the WebPageCompositor, depending on who releases
its reference first.

Fixed by disconnecting the objects properly, regardless of who goes
away first.

Reviewed internally by Mike Lattanzio.

PR #156444

• Api/WebPage.cpp:

(BlackBerry::WebKit::WebPagePrivate::setCompositor):
(BlackBerry::WebKit::WebPagePrivate::destroyCompositor):

• Api/WebPageCompositor.cpp:

(BlackBerry::WebKit::WebPageCompositor::~WebPageCompositor):
(BlackBerry::WebKit::WebPageCompositor::client):

• Api/WebPageCompositor_p.h:

(BlackBerry::WebKit::WebPageCompositorPrivate::setPage):

Location:

trunk/Source/WebKit/blackberry

Files:

• Api/WebPage.cpp (modified) (2 diffs)
• Api/WebPageCompositor.cpp (modified) (2 diffs)
• Api/WebPageCompositor_p.h (modified) (1 diff)
• ChangeLog (modified) (1 diff)

trunk/Source/WebKit/blackberry/Api/WebPage.cpp

@@ -5631 +5631 @@
 
     m_compositor = compositor;
+    if (m_compositor)
+        m_compositor->setPage(this);
 
     // The previous compositor, if any, has now released it's OpenGL resources,
@@ -5863 +5865 @@
         return;
 
+    // m_compositor is a RefPtr, so it may live on beyond this point.
+    // Disconnect the compositor from us
+    m_compositor->setPage(0);
     m_compositor.clear();
     m_ownedContext.clear();

trunk/Source/WebKit/blackberry/Api/WebPageCompositor.cpp

@@ -191 +191 @@
     using namespace BlackBerry::Platform;
 
-    webKitThreadMessageClient()->dispatchMessage(createMethodCallMessage(&WebPagePrivate::setCompositor, d->page(), PassRefPtr<WebPageCompositorPrivate>(0)));
+    // If we're being destroyed before the page, send a message to disconnect us
+    if (d->page())
+        webKitThreadMessageClient()->dispatchMessage(createMethodCallMessage(&WebPagePrivate::setCompositor, d->page(), PassRefPtr<WebPageCompositorPrivate>(0)));
     d->compositorDestroyed();
     d->deref();
@@ -198 +200 @@
 WebPageCompositorClient* WebPageCompositor::client() const
 {
-    return 0;
+    return d->client();
 }
 

trunk/Source/WebKit/blackberry/Api/WebPageCompositor_p.h

@@ -83 +83 @@
 
     WebPagePrivate* page() const { return m_webPage; }
+    void setPage(WebPagePrivate* page) { m_webPage = page; }
     WebPageCompositorClient* client() const { return m_client; }
     void compositorDestroyed();

trunk/Source/WebKit/blackberry/ChangeLog

@@ +1 @@
+2012-05-27  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Crash when deleting WebPageCompositor
+        https://bugs.webkit.org/show_bug.cgi?id=87589
+
+        Reviewed by Rob Buis.
+
+        The WebPageCompositorPrivate is reference counted, so it may outlive
+        either the WebPage or the WebPageCompositor, depending on who releases
+        its reference first.
+
+        Fixed by disconnecting the objects properly, regardless of who goes
+        away first.
+
+        Reviewed internally by Mike Lattanzio.
+
+        PR #156444
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setCompositor):
+        (BlackBerry::WebKit::WebPagePrivate::destroyCompositor):
+        * Api/WebPageCompositor.cpp:
+        (BlackBerry::WebKit::WebPageCompositor::~WebPageCompositor):
+        (BlackBerry::WebKit::WebPageCompositor::client):
+        * Api/WebPageCompositor_p.h:
+        (BlackBerry::WebKit::WebPageCompositorPrivate::setPage):
+
 2012-05-27  Arvid Nilsson  <anilsson@rim.com>