Changeset 188991 in webkit

Timestamp:

Aug 26, 2015 2:54:41 PM (9 years ago)

Author:

Wenson Hsieh

Message:

Fix crash due to animationDidEnd called on deallocated RemoteLayerTreeHost
​https://bugs.webkit.org/show_bug.cgi?id=148442
<rdar://problem/21609257>

Reviewed by Tim Horton.

A PlatformCAAnimationRemote's backpointer to a deallocated RemoteLayerTreeHost is not
invalidated when its host removes its reference to it.

• UIProcess/mac/RemoteLayerTreeHost.mm:

(WebKit::RemoteLayerTreeHost::layerWillBeRemoved): Invalidate a backpointer from the

PlatformCAAnimationRemotes to the RemoteLayerTreeHost.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/mac/RemoteLayerTreeHost.mm (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-08-26  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Fix crash due to animationDidEnd called on deallocated RemoteLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=148442
+        <rdar://problem/21609257>
+
+        Reviewed by Tim Horton.
+
+        A PlatformCAAnimationRemote's backpointer to a deallocated RemoteLayerTreeHost is not
+        invalidated when its host removes its reference to it.
+
+        * UIProcess/mac/RemoteLayerTreeHost.mm:
+        (WebKit::RemoteLayerTreeHost::layerWillBeRemoved): Invalidate a backpointer from the
+            PlatformCAAnimationRemotes to the RemoteLayerTreeHost.
+
 2015-08-26  Beth Dakin  <bdakin@apple.com>
 

trunk/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm

@@ -139 +139 @@
 void RemoteLayerTreeHost::layerWillBeRemoved(WebCore::GraphicsLayer::PlatformLayerID layerID)
 {
-    m_animationDelegates.remove(layerID);
+    auto iter = m_animationDelegates.find(layerID);
+    if (iter != m_animationDelegates.end()) {
+        [iter->value invalidate];
+        m_animationDelegates.remove(iter);
+    }
     m_layers.remove(layerID);
 }