Changeset 103760 in webkit

Timestamp:

Dec 28, 2011 4:04:28 AM (12 years ago)

Author:

kbalazs@webkit.org

Message:

[Qt][WK2] Crash in ~WebGraphicsLayer when running fast/multicol/pagination-* tests
​https://bugs.webkit.org/show_bug.cgi?id=75000

Reviewed by Noam Rosenthal.

Don't adopt a tile client that belongs to a parent layer.
This is unnecessary and also unsafe because we can live
through that client.

• WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:

(WebCore::WebGraphicsLayer::syncCompositingStateForThisLayerOnly):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebCoreSupport/WebGraphicsLayer.cpp (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2011-12-28  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] Crash in ~WebGraphicsLayer when running fast/multicol/pagination-* tests
+        https://bugs.webkit.org/show_bug.cgi?id=75000
+
+        Reviewed by Noam Rosenthal.
+
+        Don't adopt a tile client that belongs to a parent layer.
+        This is unnecessary and also unsafe because we can live
+        through that client.
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::syncCompositingStateForThisLayerOnly):
+
 2011-12-27  Dan Bernstein  <mitz@apple.com>
 

trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp

@@ -402 +402 @@
 void WebGraphicsLayer::syncCompositingStateForThisLayerOnly()
 {
-    if (!m_layerTreeTileClient)
-        m_layerTreeTileClient = layerTreeTileClient();
     updateContentBuffers();
 
@@ -434 +432 @@
         m_layerInfo.children.append(toWebLayerID(children()[i]));
 
+    WebLayerTreeTileClient* tileClient = layerTreeTileClient();
+    ASSERT(tileClient);
     if (m_layerInfo.imageIsUpdated && m_image && !m_layerInfo.imageBackingStoreID)
-        m_layerInfo.imageBackingStoreID = layerTreeTileClient()->adoptImageBackingStore(m_image.get());
-
-    m_layerTreeTileClient->didSyncCompositingStateForLayer(m_layerInfo);
+        m_layerInfo.imageBackingStoreID = tileClient->adoptImageBackingStore(m_image.get());
+
+    tileClient->didSyncCompositingStateForLayer(m_layerInfo);
     m_modified = false;
     m_layerInfo.imageIsUpdated = false;