Changeset 211792 in webkit

Timestamp:

Feb 7, 2017 1:33:29 AM (7 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r211348 - [Threaded Compositor] Crash when detaching the CoordinatedGraphicsScene
​https://bugs.webkit.org/show_bug.cgi?id=167547

Reviewed by Michael Catanzaro.

It seems that commitSceneState() can be called after the CoordinatedGraphicsScene has been detached.

• Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:

(WebKit::CoordinatedGraphicsScene::commitSceneState): Return early if scene has been detached.
(WebKit::CoordinatedGraphicsScene::detach): Take the render queue lock before clearing the render queue.

Location:

releases/WebKitGTK/webkit-2.14/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp (modified) (2 diffs)

releases/WebKitGTK/webkit-2.14/Source/WebKit2/ChangeLog

@@ +1 @@
+2017-01-28  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [Threaded Compositor] Crash when detaching the CoordinatedGraphicsScene
+        https://bugs.webkit.org/show_bug.cgi?id=167547
+
+        Reviewed by Michael Catanzaro.
+
+        It seems that commitSceneState() can be called after the CoordinatedGraphicsScene has been detached.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
+        (WebKit::CoordinatedGraphicsScene::commitSceneState): Return early if scene has been detached.
+        (WebKit::CoordinatedGraphicsScene::detach): Take the render queue lock before clearing the render queue.
+
 2017-01-28  Carlos Garcia Campos  <cgarcia@igalia.com>
 

releases/WebKitGTK/webkit-2.14/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp

@@ -599 +599 @@
 void CoordinatedGraphicsScene::commitSceneState(const CoordinatedGraphicsState& state)
 {
+    if (!m_client)
+        return;
+
     m_renderedContentsScrollPosition = state.scrollPosition;
 
@@ -708 +711 @@
 {
     ASSERT(isMainThread());
-    m_renderQueue.clear();
     m_isActive = false;
     m_client = nullptr;
+    LockHolder locker(m_renderQueueMutex);
+    m_renderQueue.clear();
 }