Changeset 186485 in webkit

Timestamp:

Jul 7, 2015, 4:54:11 PM (10 years ago)

Author:

timothy_horton@apple.com

Message:

Occasional null deref in the CA callback in flushLayers()
​https://bugs.webkit.org/show_bug.cgi?id=146700
<rdar://problem/21668754>

Reviewed by Simon Fraser.

• WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:

(WebKit::TiledCoreAnimationDrawingArea::flushLayers):

• WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:

(WebKit::RemoteLayerTreeDrawingArea::flushLayers):
Make sure we keep the WebPage alive, and null-check the potentially null
WebCore objects (Page and Frame).

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm (modified) (1 diff)
• WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-07-07  Tim Horton  <timothy_horton@apple.com>
+
+        Occasional null deref in the CA callback in flushLayers()
+        https://bugs.webkit.org/show_bug.cgi?id=146700
+        <rdar://problem/21668754>
+
+        Reviewed by Simon Fraser.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::flushLayers):
+        * WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:
+        (WebKit::RemoteLayerTreeDrawingArea::flushLayers):
+        Make sure we keep the WebPage alive, and null-check the potentially null
+        WebCore objects (Page and Frame).
+
 2015-07-06  Matt Rajca  <mrajca@apple.com>
 

trunk/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm

@@ -363 +363 @@
 
 #if (TARGET_OS_IPHONE && __IPHONE_OS_VERSION_MIN_REQUIRED >= 90000) || (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101100)
-    [CATransaction addCommitHandler:^{
-        m_webPage.corePage()->inspectorController().didComposite(m_webPage.mainFrameView()->frame());
+    RefPtr<WebPage> retainedPage = &m_webPage;
+    [CATransaction addCommitHandler:[retainedPage] {
+        if (Page* corePage = retainedPage->corePage()) {
+            if (Frame* coreFrame = retainedPage->mainFrame())
+                corePage->inspectorController().didComposite(*coreFrame);
+        }
     } forPhase:kCATransactionPhasePostCommit];
 #endif

trunk/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm

@@ -392 +392 @@
 
 #if (TARGET_OS_IPHONE && __IPHONE_OS_VERSION_MIN_REQUIRED >= 90000) || (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101100)
-        [CATransaction addCommitHandler:^{
-            m_webPage.corePage()->inspectorController().didComposite(m_webPage.mainFrameView()->frame());
+        RefPtr<WebPage> retainedPage = &m_webPage;
+        [CATransaction addCommitHandler:[retainedPage] {
+            if (Page* corePage = retainedPage->corePage()) {
+                if (Frame* coreFrame = retainedPage->mainFrame())
+                    corePage->inspectorController().didComposite(*coreFrame);
+            }
         } forPhase:kCATransactionPhasePostCommit];
 #endif