Changeset 216273 in webkit

Timestamp:

May 5, 2017 2:35:54 PM (7 years ago)

Author:

Said Abou-Hallawa

Message:

Crash in ImageFrameCache::decodedSizeChanged() after image load cancellation
​https://bugs.webkit.org/show_bug.cgi?id=171736

Reviewed by Tim Horton.

Tests: Covered by run-webkit-tests fast/images/image-formats-support.html
--guard-malloc.

Because an image format is not supported, the ImageObserver of the Image
is deleted then the Image itself is deleted. In BitmapImage destructor,
we make a call which ends up accessing the deleted ImageObserver.

To fix this, we need to setImageObsever of the Image to-be-deleted to
nullptr. So the Image can avoid accessing its ImageObserver, while it is
being deleted. Also we can change the BitImage destructor to avoid calling
ImageFrameCache::decodedSizeChanged() since it is not really needed.

• loader/cache/CachedImage.cpp:

(WebCore::CachedImage::clearImage):

• platform/graphics/BitmapImage.cpp:

(WebCore::BitmapImage::~BitmapImage):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/cache/CachedImage.cpp (modified) (1 diff)
• platform/graphics/BitmapImage.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-05-05  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Crash in ImageFrameCache::decodedSizeChanged() after image load cancellation
+        https://bugs.webkit.org/show_bug.cgi?id=171736
+
+        Reviewed by Tim Horton.
+
+        Tests: Covered by run-webkit-tests fast/images/image-formats-support.html
+        --guard-malloc.
+
+        Because an image format is not supported, the ImageObserver of the Image
+        is deleted then the Image itself is deleted. In BitmapImage destructor,
+        we make a call which ends up accessing the deleted ImageObserver.
+
+        To fix this, we need to setImageObsever of the Image to-be-deleted to 
+        nullptr. So the Image can avoid accessing its ImageObserver, while it is
+        being deleted. Also we can change the BitImage destructor to avoid calling 
+        ImageFrameCache::decodedSizeChanged() since it is not really needed.
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::clearImage):
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::~BitmapImage):
+
 2017-05-05  Brian Burg  <bburg@apple.com>
 

trunk/Source/WebCore/loader/cache/CachedImage.cpp

@@ -361 +361 @@
         m_imageObserver = nullptr;
     }
-    m_image = nullptr;
+    if (m_image) {
+        m_image->setImageObserver(nullptr);
+        m_image = nullptr;
+    }
 }
 

trunk/Source/WebCore/platform/graphics/BitmapImage.cpp

@@ -62 +62 @@
 {
     invalidatePlatformData();
-    stopAnimation();
+    clearTimer();
+    m_source.stopAsyncDecodingQueue();
 }