Changeset 176996 in webkit

Timestamp:

Dec 8, 2014, 5:20:52 PM (10 years ago)

Author:

mitz@apple.com

Message:

<rdar://problem/18905383> [iOS] Crash due to null m_webPageProxyForBackForwardListForCurrentSwipe in ViewGestureController::endSwipeGesture
​https://bugs.webkit.org/show_bug.cgi?id=138750

Reviewed by Tim Horton.

The snapshot for the current gesture was being removed mid-gesture by the callback from
dispatchAfterEnsuringDrawing scheduled by the previous gesture. The fix is to ignore the
callback for a gesture if it is made after the snapshot for that gesture has already been
removed (which can happen as a result of the watchdog timer firing).

• UIProcess/ios/ViewGestureControllerIOS.mm:

(WebKit::ViewGestureController::ViewGestureController): Initialize new member variable.
(WebKit::addLogEntry): Fixed the log message format.
(WebKit::ViewGestureController::endSwipeGesture): When dispatchAfterEnsuringDrawing() calls
us back, bail out if the gesture snapshot has already been removed.
(WebKit::ViewGestureController::removeSwipeSnapshot): Increment
m_gesturePendingSnapshotRemoval.

• UIProcess/mac/ViewGestureController.h: Added m_gesturePendingSnapshotRemoval member

variable.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (2 diffs)
• UIProcess/ios/ViewGestureControllerIOS.mm (modified) (4 diffs)
• UIProcess/mac/ViewGestureController.h (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-12-08  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/18905383> [iOS] Crash due to null m_webPageProxyForBackForwardListForCurrentSwipe in ViewGestureController::endSwipeGesture
+        https://bugs.webkit.org/show_bug.cgi?id=138750
+
+        Reviewed by Tim Horton.
+
+        The snapshot for the current gesture was being removed mid-gesture by the callback from
+        dispatchAfterEnsuringDrawing scheduled by the previous gesture. The fix is to ignore the
+        callback for a gesture if it is made after the snapshot for that gesture has already been
+        removed (which can happen as a result of the watchdog timer firing).
+
+        * UIProcess/ios/ViewGestureControllerIOS.mm:
+        (WebKit::ViewGestureController::ViewGestureController): Initialize new member variable.
+        (WebKit::addLogEntry): Fixed the log message format.
+        (WebKit::ViewGestureController::endSwipeGesture): When dispatchAfterEnsuringDrawing() calls
+        us back, bail out if the gesture snapshot has already been removed.
+        (WebKit::ViewGestureController::removeSwipeSnapshot): Increment
+        m_gesturePendingSnapshotRemoval.
+        * UIProcess/mac/ViewGestureController.h: Added m_gesturePendingSnapshotRemoval member
+        variable.
+
 2014-12-08  Anders Carlsson  <andersca@apple.com>
 
@@ -3734 +3756 @@
         https://bugs.webkit.org/show_bug.cgi?id=138728
 
-        Reviewed by Tim HOrton.
+        Reviewed by Tim Horton.
 
         Moved the implementations from the category to the class.

trunk/Source/WebKit2/UIProcess/ios/ViewGestureControllerIOS.mm

@@ -147 +147 @@
     , m_snapshotRemovalTargetRenderTreeSize(0)
     , m_shouldRemoveSnapshotWhenTargetRenderTreeSizeHit(false)
+    , m_gesturePendingSnapshotRemoval(0)
 {
     viewGestureControllersForAllPages().add(webPageProxy.pageID(), this);
@@ -179 +180 @@
     WTFGetBacktrace(stack, &size);
     StringBuilder stringBuilder;
-    stringBuilder.append(String::format("%f [ ]", CFAbsoluteTimeGetCurrent()));
+    stringBuilder.append(String::format("%f [ ", CFAbsoluteTimeGetCurrent()));
     for (int i = 2; i < size; ++i) {
         if (i > 2)
@@ -336 +337 @@
     if (auto drawingArea = m_webPageProxy.drawingArea()) {
         uint64_t pageID = m_webPageProxy.pageID();
-        drawingArea->dispatchAfterEnsuringDrawing([pageID] (CallbackBase::Error error) {
+        uint64_t gesturePendingSnapshotRemoval = m_gesturePendingSnapshotRemoval;
+        drawingArea->dispatchAfterEnsuringDrawing([pageID, gesturePendingSnapshotRemoval] (CallbackBase::Error error) {
             auto gestureControllerIter = viewGestureControllersForAllPages().find(pageID);
-            if (gestureControllerIter != viewGestureControllersForAllPages().end())
+            if (gestureControllerIter != viewGestureControllersForAllPages().end() && gestureControllerIter->value->m_gesturePendingSnapshotRemoval == gesturePendingSnapshotRemoval)
                 gestureControllerIter->value->willCommitPostSwipeTransitionLayerTree(error == CallbackBase::Error::None);
         });
@@ -394 +396 @@
         return;
     
+    ++m_gesturePendingSnapshotRemoval;
+
 #if USE(IOSURFACE)
     if (m_currentSwipeSnapshotSurface)

trunk/Source/WebKit2/UIProcess/mac/ViewGestureController.h

@@ -216 +216 @@
     WeakObjCPtr<WKWebView> m_alternateBackForwardListSourceView;
     RefPtr<WebPageProxy> m_webPageProxyForBackForwardListForCurrentSwipe;
+    uint64_t m_gesturePendingSnapshotRemoval;
 #if ENABLE(VIEW_GESTURE_CONTROLLER_TRACING)
     Vector<String> m_logEntries;