Changeset 268835 in webkit

Timestamp:

Oct 21, 2020, 3:16:00 PM (6 years ago)

Author:

Alan Coon

Message:

Cherry-pick r268701. rdar://problem/70541911

Fix possible crash in GraphicsLayerCA::computeVisibleAndCoverageRect()
​https://bugs.webkit.org/show_bug.cgi?id=217930
<rdar://problem/70316943>

Reviewed by Tim Horton.

If we made a m_overflowControlsHostLayerAncestorClippingStack, make sure we unparent
its layers when tearing down the RenderLayerBacking, and when we determine that we
longer need a m_ancestorClippingStack (having a m_overflowControlsHostLayerAncestorClippingStack
implies that we have a m_ancestorClippingStack).

• rendering/RenderLayerBacking.cpp: (WebCore::RenderLayerBacking::destroyGraphicsLayers): (WebCore::RenderLayerBacking::updateAncestorClipping):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@268701 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-610-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderLayerBacking.cpp (modified) (2 diffs)

branches/safari-610-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2020-10-21  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r268701. rdar://problem/70541911
+
+    Fix possible crash in GraphicsLayerCA::computeVisibleAndCoverageRect()
+    https://bugs.webkit.org/show_bug.cgi?id=217930
+    <rdar://problem/70316943>
+    
+    Reviewed by Tim Horton.
+    
+    If we made a m_overflowControlsHostLayerAncestorClippingStack, make sure we unparent
+    its layers when tearing down the RenderLayerBacking, and when we determine that we
+    longer need a m_ancestorClippingStack (having a m_overflowControlsHostLayerAncestorClippingStack
+    implies that we have a m_ancestorClippingStack).
+    
+    * rendering/RenderLayerBacking.cpp:
+    (WebCore::RenderLayerBacking::destroyGraphicsLayers):
+    (WebCore::RenderLayerBacking::updateAncestorClipping):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@268701 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+            Fix possible crash in GraphicsLayerCA::computeVisibleAndCoverageRect()
+            https://bugs.webkit.org/show_bug.cgi?id=217930
+            <rdar://problem/70316943>
+
+            Reviewed by Tim Horton.
+
+            If we made a m_overflowControlsHostLayerAncestorClippingStack, make sure we unparent
+            its layers when tearing down the RenderLayerBacking, and when we determine that we
+            longer need a m_ancestorClippingStack (having a m_overflowControlsHostLayerAncestorClippingStack
+            implies that we have a m_ancestorClippingStack).
+
+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::destroyGraphicsLayers):
+            (WebCore::RenderLayerBacking::updateAncestorClipping):
+
 2020-10-21  Russell Epstein  <repstein@apple.com>
 

branches/safari-610-branch/Source/WebCore/rendering/RenderLayerBacking.cpp

@@ -584 +584 @@
     GraphicsLayer::clear(m_maskLayer);
 
-    if (m_ancestorClippingStack) {
-        for (auto& entry : m_ancestorClippingStack->stack())
-            GraphicsLayer::unparentAndClear(entry.clippingLayer);
-    }
+    if (m_ancestorClippingStack)
+        removeClippingStackLayers(*m_ancestorClippingStack);
+
+    if (m_overflowControlsHostLayerAncestorClippingStack)
+        removeClippingStackLayers(*m_overflowControlsHostLayerAncestorClippingStack);
 
     GraphicsLayer::unparentAndClear(m_contentsContainmentLayer);
@@ -1938 +1939 @@
     } else if (m_ancestorClippingStack) {
         removeClippingStackLayers(*m_ancestorClippingStack);
-
         m_ancestorClippingStack = nullptr;
+        
+        if (m_overflowControlsHostLayerAncestorClippingStack) {
+            removeClippingStackLayers(*m_overflowControlsHostLayerAncestorClippingStack);
+            m_overflowControlsHostLayerAncestorClippingStack = nullptr;
+        }
+        
         layersChanged = true;
     }