Changeset 202330 in webkit

Timestamp:

Jun 22, 2016, 9:58:17 AM (9 years ago)

Author:

Simon Fraser

Message:

Crash under GraphicsLayerCA::recursiveCommitChanges() with deep layer trees
​https://bugs.webkit.org/show_bug.cgi?id=159023
rdar://problem/25377842

Reviewed by Tim Horton.

Having an on-stack DisplayList::Recorder increased the stack frame size significantly,
causing stack exhaustion with deep layer trees, despite the existing depth check.

Make the Recorder heap-allocated to fix this.

Tested by LayoutTests/compositinglayer-creation/deep-tree.html.

• platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayerCA::recursiveCommitChanges):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/graphics/ca/GraphicsLayerCA.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-06-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Crash under GraphicsLayerCA::recursiveCommitChanges() with deep layer trees
+        https://bugs.webkit.org/show_bug.cgi?id=159023
+        rdar://problem/25377842
+
+        Reviewed by Tim Horton.
+
+        Having an on-stack DisplayList::Recorder increased the stack frame size significantly,
+        causing stack exhaustion with deep layer trees, despite the existing depth check.
+
+        Make the Recorder heap-allocated to fix this.
+
+        Tested by LayoutTests/compositing//layer-creation/deep-tree.html.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+
 2016-06-22  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp

@@ -1440 +1440 @@
 
         GraphicsContext context;
-        DisplayList::Recorder recorder(context, *m_displayList, initialClip, AffineTransform());
+        // The Recorder is large, so heap-allocate.
+        std::unique_ptr<DisplayList::Recorder> recorder = std::make_unique<DisplayList::Recorder>(context, *m_displayList, initialClip, AffineTransform());
         paintGraphicsLayerContents(context, FloatRect(FloatPoint(), size()));