Changeset 147238 in webkit

Timestamp:

Mar 29, 2013, 12:26:36 PM (13 years ago)

Author:

Simon Fraser

Message:

removeViewportConstrainedLayer() should remove the layer from m_viewportConstrainedLayersNeedingUpdate too
​https://bugs.webkit.org/show_bug.cgi?id=113596

Reviewed by Tim Horton.

It's possible, with some combination of position:fixed and opacity transitions
in iframes, to end up with a RenderLayer in m_viewportConstrainedLayersNeedingUpdate
that has been removed from m_viewportConstrainedLayers, which leads to later assertions
and/or crashes.

Fix by removing a layer from m_viewportConstrainedLayersNeedingUpdate when we
remove it from m_viewportConstrainedLayers.

I was not able to come up with a testcase that reliably reproduces this.

• rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::removeViewportConstrainedLayer):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderLayerCompositor.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-03-29  Simon Fraser  <simon.fraser@apple.com>
+
+        removeViewportConstrainedLayer() should remove the layer from m_viewportConstrainedLayersNeedingUpdate too
+        https://bugs.webkit.org/show_bug.cgi?id=113596
+
+        Reviewed by Tim Horton.
+        
+        It's possible, with some combination of position:fixed and opacity transitions
+        in iframes, to end up with a RenderLayer in m_viewportConstrainedLayersNeedingUpdate
+        that has been removed from m_viewportConstrainedLayers, which leads to later assertions
+        and/or crashes.
+        
+        Fix by removing a layer from m_viewportConstrainedLayersNeedingUpdate when we
+        remove it from m_viewportConstrainedLayers.
+
+        I was not able to come up with a testcase that reliably reproduces this.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::removeViewportConstrainedLayer):
+
 2013-03-29  Greg Hughes  <ghughes@apple.com>
 

trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp

@@ -2979 +2979 @@
     unregisterViewportConstrainedLayer(layer);
     m_viewportConstrainedLayers.remove(layer);
+    m_viewportConstrainedLayersNeedingUpdate.remove(layer);
 }