Changeset 201595 in webkit

Timestamp:

Jun 2, 2016, 12:36:21 AM (10 years ago)

Author:

Carlos Garcia Campos

Message:

[Wayland] PlatformDisplayWayland destructor is super crashy
​https://bugs.webkit.org/show_bug.cgi?id=157973

Reviewed by Michael Catanzaro.

EGL registers two at exist callbacks one to finish the display and another one to unload drivers, the one to
finish the display happens first. When our destructor is called the _eglFiniDisplay callback has already been
called, so we have a valid pointer for an already finished display. Then eglTerminate tries to find the display
in the global display list, but fails and for some reason it crashes when trying to return an error.
If atexit is called after the global PlatformDisplay constructor, the atexit handler is called before the
destructor. The atexit callbacks are called in reverse order, so if we register an atexit handler after the
global instace has been created and after EGL has been initialized, we could terminate the EGL display before
the EGL atexit handlers and the global PlatformDisplay destructor.

• platform/graphics/PlatformDisplay.cpp:

(WebCore::PlatformDisplay::initializeEGLDisplay):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/graphics/PlatformDisplay.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-06-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [Wayland] PlatformDisplayWayland destructor is super crashy
+        https://bugs.webkit.org/show_bug.cgi?id=157973
+
+        Reviewed by Michael Catanzaro.
+
+        EGL registers two at exist callbacks one to finish the display and another one to unload drivers, the one to
+        finish the display happens first. When our destructor is called the _eglFiniDisplay callback has already been
+        called, so we have a valid pointer for an already finished display. Then eglTerminate tries to find the display
+        in the global display list, but fails and for some reason it crashes when trying to return an error.
+        If atexit is called after the global PlatformDisplay constructor, the atexit handler is called before the
+        destructor. The atexit callbacks are called in reverse order, so if we register an atexit handler after the
+        global instace has been created and after EGL has been initialized, we could terminate the EGL display before
+        the EGL atexit handlers and the global PlatformDisplay destructor.
+
+        * platform/graphics/PlatformDisplay.cpp:
+        (WebCore::PlatformDisplay::initializeEGLDisplay):
+
 2016-06-01  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/platform/graphics/PlatformDisplay.cpp

@@ -113 +113 @@
 PlatformDisplay::~PlatformDisplay()
 {
-    // WinCairo crashes when terminating EGL on exit.
-    // https://bugs.webkit.org/show_bug.cgi?id=145832
-#if USE(EGL) && !PLATFORM(WIN)
-    terminateEGLDisplay();
+#if USE(EGL)
+    ASSERT(m_eglDisplay == EGL_NO_DISPLAY);
 #endif
 }
@@ -160 +158 @@
         return;
     }
+
+    // EGL registers atexit handlers to cleanup its global display list.
+    // Since the global PlatformDisplay instance is created before,
+    // when the PlatformDisplay destructor is called, EGL has already removed the
+    // display from the list, causing eglTerminate() to crash. So, here we register
+    // our own atexit handler, after EGL has been initialized and after the global
+    // instance has been created to ensure we call eglTerminate() before the other
+    // EGL atexit handlers and the PlatformDisplay destructor.
+    // See https://bugs.webkit.org/show_bug.cgi?id=157973.
+    std::atexit([] { PlatformDisplay::sharedDisplay().terminateEGLDisplay(); });
 }
 
 void PlatformDisplay::terminateEGLDisplay()
 {
+    ASSERT(m_eglDisplayInitialized);
     if (m_eglDisplay == EGL_NO_DISPLAY)
         return;