Changeset 268701 in webkit

Timestamp:

Oct 19, 2020, 5:08:38 PM (6 years ago)

Author:

Simon Fraser

Message:

Fix possible crash in GraphicsLayerCA::computeVisibleAndCoverageRect()
​https://bugs.webkit.org/show_bug.cgi?id=217930
<rdar://problem/70316943>

Reviewed by Tim Horton.

If we made a m_overflowControlsHostLayerAncestorClippingStack, make sure we unparent
its layers when tearing down the RenderLayerBacking, and when we determine that we
longer need a m_ancestorClippingStack (having a m_overflowControlsHostLayerAncestorClippingStack
implies that we have a m_ancestorClippingStack).

• rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::destroyGraphicsLayers):
(WebCore::RenderLayerBacking::updateAncestorClipping):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderLayerBacking.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix possible crash in GraphicsLayerCA::computeVisibleAndCoverageRect()
+        https://bugs.webkit.org/show_bug.cgi?id=217930
+        <rdar://problem/70316943>
+
+        Reviewed by Tim Horton.
+
+        If we made a m_overflowControlsHostLayerAncestorClippingStack, make sure we unparent
+        its layers when tearing down the RenderLayerBacking, and when we determine that we
+        longer need a m_ancestorClippingStack (having a m_overflowControlsHostLayerAncestorClippingStack
+        implies that we have a m_ancestorClippingStack).
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::destroyGraphicsLayers):
+        (WebCore::RenderLayerBacking::updateAncestorClipping):
+
 2020-10-19  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/rendering/RenderLayerBacking.cpp

@@ -579 +579 @@
     GraphicsLayer::clear(m_maskLayer);
 
-    if (m_ancestorClippingStack) {
-        for (auto& entry : m_ancestorClippingStack->stack())
-            GraphicsLayer::unparentAndClear(entry.clippingLayer);
-    }
+    if (m_ancestorClippingStack)
+        removeClippingStackLayers(*m_ancestorClippingStack);
+
+    if (m_overflowControlsHostLayerAncestorClippingStack)
+        removeClippingStackLayers(*m_overflowControlsHostLayerAncestorClippingStack);
 
     GraphicsLayer::unparentAndClear(m_contentsContainmentLayer);
@@ -1927 +1928 @@
     } else if (m_ancestorClippingStack) {
         removeClippingStackLayers(*m_ancestorClippingStack);
-
         m_ancestorClippingStack = nullptr;
+        
+        if (m_overflowControlsHostLayerAncestorClippingStack) {
+            removeClippingStackLayers(*m_overflowControlsHostLayerAncestorClippingStack);
+            m_overflowControlsHostLayerAncestorClippingStack = nullptr;
+        }
+        
         layersChanged = true;
     }