Crash in WebKit::RemoteLayerTreePropertyApplier::updateChildren

https://bugs.webkit.org/show_bug.cgi?id=193897
<rdar://problem/47427750>

Reviewed by Simon Fraser.

There has been some null pointer crashes where we fail to find a remote layer tree node that matches
the transaction properties.

* Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:
(WebKit::RemoteLayerTreePropertyApplier::updateChildren):

Null check the nodes.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@240717 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 11d679e..3bce74d 100644 (file)
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,19 @@
+2019-01-30  Antti Koivisto  <antti@apple.com>
+
+        Crash in WebKit::RemoteLayerTreePropertyApplier::updateChildren
+        https://bugs.webkit.org/show_bug.cgi?id=193897
+        <rdar://problem/47427750>
+
+        Reviewed by Simon Fraser.
+
+        There has been some null pointer crashes where we fail to find a remote layer tree node that matches
+        the transaction properties.
+
+        * Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:
+        (WebKit::RemoteLayerTreePropertyApplier::updateChildren):
+
+        Null check the nodes.
+
 2019-01-30  Simon Fraser  <simon.fraser@apple.com>
 
         Add some basic geometry information to the scrolling tree

diff --git a/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm b/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm
index 8217371..cddbc00 100644 (file)
--- a/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm
+++ b/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm
@@ -277,7 +277,11 @@ void RemoteLayerTreePropertyApplier::updateChildren(RemoteLayerTreeNode& node, c
     auto hasViewChildren = [&] {
         if (node.uiView() && [[node.uiView() subviews] count])
             return true;
-        return !properties.children.isEmpty() && relatedLayers.get(properties.children.first())->uiView();
+        if (properties.children.isEmpty())
+            return false;
+        auto* childNode = relatedLayers.get(properties.children.first());
+        ASSERT(childNode);
+        return childNode && childNode->uiView();
     };
 
     auto contentView = [&] {
@@ -295,6 +299,9 @@ void RemoteLayerTreePropertyApplier::updateChildren(RemoteLayerTreeNode& node, c
         RetainPtr<NSMutableArray> subviews = adoptNS([[NSMutableArray alloc] initWithCapacity:properties.children.size()]);
         for (auto& child : properties.children) {
             auto* childNode = relatedLayers.get(child);
+            ASSERT(childNode);
+            if (!childNode)
+                continue;
             ASSERT(childNode->uiView());
             [subviews addObject:childNode->uiView()];
         }
@@ -307,6 +314,9 @@ void RemoteLayerTreePropertyApplier::updateChildren(RemoteLayerTreeNode& node, c
     RetainPtr<NSMutableArray> sublayers = adoptNS([[NSMutableArray alloc] initWithCapacity:properties.children.size()]);
     for (auto& child : properties.children) {
         auto* childNode = relatedLayers.get(child);
+        ASSERT(childNode);
+        if (!childNode)
+            continue;
 #if PLATFORM(IOS_FAMILY)
         ASSERT(!childNode->uiView());
 #endif
@@ -339,7 +349,11 @@ void RemoteLayerTreePropertyApplier::updateMask(RemoteLayerTreeNode& node, const
         return;
     }
 
-    CALayer *maskLayer = relatedLayers.get(properties.maskLayerID)->layer();
+    auto* maskNode = relatedLayers.get(properties.maskLayerID);
+    ASSERT(maskNode);
+    if (!maskNode)
+        return;
+    CALayer *maskLayer = maskNode->layer();
     ASSERT(!maskLayer.superlayer);
     if (maskLayer.superlayer)
         return;