Changeset 183774 in webkit

Timestamp:

May 4, 2015 3:14:33 PM (9 years ago)

Author:

jer.noble@apple.com

Message:

[iOS] Crash in -[WebCALayerHostWrapper resolveBounds]
​https://bugs.webkit.org/show_bug.cgi?id=144595

Reviewed by Eric Carlson.

It is possible for a WebCALayorHostWrapper to outlive the WebVideoFullscreenModel to which it refers,
since the model pointer is bare, rather than a RefPtr. The reference to the model must be invalidated
before the model is destroyed.

• platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(WebVideoFullscreenInterfaceAVKit::cleanupFullscreenInternal):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/ios/WebVideoFullscreenInterfaceAVKit.mm (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-05-04  Jer Noble  <jer.noble@apple.com>
+
+        [iOS] Crash in -[WebCALayerHostWrapper resolveBounds]
+        https://bugs.webkit.org/show_bug.cgi?id=144595
+
+        Reviewed by Eric Carlson.
+
+        It is possible for a WebCALayorHostWrapper to outlive the WebVideoFullscreenModel to which it refers,
+        since the model pointer is bare, rather than a RefPtr. The reference to the model must be invalidated
+        before the model is destroyed.
+
+        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
+        (WebVideoFullscreenInterfaceAVKit::cleanupFullscreenInternal):
+
 2015-05-04  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/platform/ios/WebVideoFullscreenInterfaceAVKit.mm

@@ -1160 +1160 @@
     [[m_viewController view] removeFromSuperview];
 
+    [m_layerHostWrapper setModel:nullptr];
+
     m_layerHostWrapper = nil;
     m_videoLayer = nil;