git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: a6606c7)
Fix crash when reflections and backdrop filter are combined
authorsimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 29 Aug 2018 19:57:32 +0000 (19:57 +0000)
committersimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 29 Aug 2018 19:57:32 +0000 (19:57 +0000)
https://bugs.webkit.org/show_bug.cgi?id=188504
rdar://problem/43225590

Reviewed by Dan Bates.
Source/WebCore:

GraphicsLayerCA::updateBackdropFiltersRect() was confused about which hash map to modify
when changes to the clipping rect affect whether we make backdrop clipping layers;
we need to add/remove from backdropClippingLayerClones, not backdropLayerClones.

Test: compositing/filters/backdrop-filter-update-rect.html

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::updateBackdropFiltersRect):

LayoutTests:

* compositing/filters/backdrop-filter-update-rect-expected.txt: Added.
* compositing/filters/backdrop-filter-update-rect.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235475 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/compositing/filters/backdrop-filter-update-rect-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/compositing/filters/backdrop-filter-update-rect.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 4b4ed54..d8375ef 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2018-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix crash when reflections and backdrop filter are combined
+        https://bugs.webkit.org/show_bug.cgi?id=188504
+        rdar://problem/43225590
+
+        Reviewed by Dan Bates.
+
+        * compositing/filters/backdrop-filter-update-rect-expected.txt: Added.
+        * compositing/filters/backdrop-filter-update-rect.html: Added.
+
 2018-08-29  Ali Juma  <ajuma@chromium.org>
 
         [mac-wk1] Mark three IntersectionObserver web platform tests as flaky
diff --git a/LayoutTests/compositing/filters/backdrop-filter-update-rect-expected.txt b/LayoutTests/compositing/filters/backdrop-filter-update-rect-expected.txt
new file mode 100644 (file)
index 0000000..e1b7714
--- /dev/null
+++ b/LayoutTests/compositing/filters/backdrop-filter-update-rect-expected.txt
@@ -0,0 +1,3 @@
+This test should not crash.
+
+box
diff --git a/LayoutTests/compositing/filters/backdrop-filter-update-rect.html b/LayoutTests/compositing/filters/backdrop-filter-update-rect.html
new file mode 100644 (file)
index 0000000..bf80a08
--- /dev/null
+++ b/LayoutTests/compositing/filters/backdrop-filter-update-rect.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <style>
+        #box {
+            height: 100px;
+            width: 100px;
+            margin: 10px;
+            -webkit-backdrop-filter: blur(10px);
+            -webkit-box-reflect: below 10px;
+        }
+        
+        #box.changed {
+            width: 110px;
+        }
+    </style>
+    <script>
+        if (window.testRunner) {
+            testRunner.waitUntilDone();
+            testRunner.dumpAsText();
+        }
+            
+        function doTest()
+        {
+            setTimeout(() => {
+                document.getElementById('box').classList.add('changed');
+
+                if (window.testRunner)
+                    testRunner.notifyDone();
+            }, 0);
+        }
+        window.addEventListener('load', doTest, false);
+    </script>
+</head>
+<body>
+    <p>This test should not crash.</p>
+    <div id="box">
+        box
+    </div>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index d372527..52565bc 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2018-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix crash when reflections and backdrop filter are combined
+        https://bugs.webkit.org/show_bug.cgi?id=188504
+        rdar://problem/43225590
+
+        Reviewed by Dan Bates.
+        
+        GraphicsLayerCA::updateBackdropFiltersRect() was confused about which hash map to modify
+        when changes to the clipping rect affect whether we make backdrop clipping layers;
+        we need to add/remove from backdropClippingLayerClones, not backdropLayerClones.
+
+        Test: compositing/filters/backdrop-filter-update-rect.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateBackdropFiltersRect):
+
 2018-08-29  Jer Noble  <jer.noble@apple.com>
 
         Muted elements do not have their Now Playing status updated when unmuted.
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index 293806c..a47c094 100644 (file)
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -2186,15 +2186,15 @@ void GraphicsLayerCA::updateBackdropFiltersRect()
             backdropCloneLayer->setPosition(m_backdropFiltersRect.rect().location());
 
             CloneID cloneID = clone.key;
-            RefPtr<PlatformCALayer> backdropClippingLayerClone = m_layerClones->backdropLayerClones.get(cloneID);
+            RefPtr<PlatformCALayer> backdropClippingLayerClone = m_layerClones->backdropClippingLayerClones.get(cloneID);
 
             bool hadBackdropClippingLayer = backdropClippingLayerClone;
             updateClippingStrategy(*backdropCloneLayer, backdropClippingLayerClone, m_backdropFiltersRect);
 
             if (!backdropClippingLayerClone)
-                m_layerClones->backdropLayerClones.remove(cloneID);
+                m_layerClones->backdropClippingLayerClones.remove(cloneID);
             else if (backdropClippingLayerClone && !hadBackdropClippingLayer)
-                m_layerClones->backdropLayerClones.add(cloneID, backdropClippingLayerClone);
+                m_layerClones->backdropClippingLayerClones.add(cloneID, backdropClippingLayerClone);
         }
     }
 }
Mirror of the WebKit open source project from svn.webkit.org.