Changeset 174799 in webkit

Timestamp:

Oct 16, 2014 4:39:09 PM (10 years ago)

Author:

Simon Fraser

Message:

Crash under RemoteLayerTreeHost::getLayer() when closing a tab
​https://bugs.webkit.org/show_bug.cgi?id=137796
rdar://problem/18547565

Reviewed by Tim Horton.

CA can call our animation delegate after the RemoteLayerTreeHost has been
destroyed. CAAnimation retains its delegate, so it's safe for us to null out
the WKAnimationDelegate's pointer to the RemoteLayerTreeHost when tearing down
the RemoteLayerTreeHost.

• UIProcess/mac/RemoteLayerTreeHost.mm:

(WebKit::RemoteLayerTreeHost::~RemoteLayerTreeHost):
(WebKit::RemoteLayerTreeHost::animationDidEnd):

• WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm:

(-[WKAnimationDelegate invalidate]):
(-[WKAnimationDelegate animationDidStart:]):
(-[WKAnimationDelegate animationDidStop:finished:]):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/mac/RemoteLayerTreeHost.mm (modified) (2 diffs)
• WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm (modified) (3 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Crash under RemoteLayerTreeHost::getLayer() when closing a tab
+        https://bugs.webkit.org/show_bug.cgi?id=137796
+        rdar://problem/18547565
+
+        Reviewed by Tim Horton.
+        
+        CA can call our animation delegate after the RemoteLayerTreeHost has been
+        destroyed. CAAnimation retains its delegate, so it's safe for us to null out
+        the WKAnimationDelegate's pointer to the RemoteLayerTreeHost when tearing down
+        the RemoteLayerTreeHost.
+
+        * UIProcess/mac/RemoteLayerTreeHost.mm:
+        (WebKit::RemoteLayerTreeHost::~RemoteLayerTreeHost):
+        (WebKit::RemoteLayerTreeHost::animationDidEnd):
+        * WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm:
+        (-[WKAnimationDelegate invalidate]):
+        (-[WKAnimationDelegate animationDidStart:]):
+        (-[WKAnimationDelegate animationDidStop:finished:]):
+
 2014-10-16  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm

@@ -55 +55 @@
 RemoteLayerTreeHost::~RemoteLayerTreeHost()
 {
+    for (auto& delegate : m_animationDelegates.values())
+        [delegate.get() invalidate];
+
     clearLayers();
 }
@@ -169 +172 @@
     if (!animationKey.isEmpty())
         m_drawingArea.acceleratedAnimationDidEnd(layerID, animationKey);
-
 }
 

trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm

@@ -55 +55 @@
 
 - (instancetype)initWithLayerID:(GraphicsLayer::PlatformLayerID)layerID layerTreeHost:(WebKit::RemoteLayerTreeHost*)layerTreeHost;
+- (void)invalidate;
 @end
 
@@ -68 +69 @@
 }
 
+- (void)invalidate
+{
+    _layerTreeHost = nullptr;
+}
+
 - (void)animationDidStart:(CAAnimation *)animation
 {
+    if (!_layerTreeHost)
+        return;
+
     bool hasExplicitBeginTime = [[animation valueForKey:WKExplicitBeginTimeFlag] boolValue];
     CFTimeInterval startTime;
@@ -85 +94 @@
 - (void)animationDidStop:(CAAnimation *)animation finished:(BOOL)finished
 {
+    if (!_layerTreeHost)
+        return;
+
     _layerTreeHost->animationDidEnd(_layerID, animation);
 }