[iOS WK2] Hash table assertion closing a tab
authorsimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 14 Apr 2014 22:37:07 +0000 (22:37 +0000)
committersimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 14 Apr 2014 22:37:07 +0000 (22:37 +0000)
https://bugs.webkit.org/show_bug.cgi?id=131640

Reviewed by Tim Horton.

Have RemoteLayerTreeContext keep track of all PlatformCALayerRemotes,
and clear their context pointer when it is being destroyed to avoid
calling into a deleted object later.

* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(WebKit::PlatformCALayerRemote::~PlatformCALayerRemote):
(WebKit::PlatformCALayerRemote::addAnimationForKey):
* WebProcess/WebPage/mac/PlatformCALayerRemote.h:
(WebKit::PlatformCALayerRemote::clearContext):
* WebProcess/WebPage/mac/RemoteLayerTreeContext.h:
* WebProcess/WebPage/mac/RemoteLayerTreeContext.mm:
(WebKit::RemoteLayerTreeContext::~RemoteLayerTreeContext):
(WebKit::RemoteLayerTreeContext::layerWasCreated):
(WebKit::RemoteLayerTreeContext::layerWillBeDestroyed):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167273 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit2/ChangeLog
Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.cpp
Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemote.h
Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.h
Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeContext.mm

index db56335..2936a42 100644 (file)
@@ -1,3 +1,25 @@
+2014-04-14  Simon Fraser  <simon.fraser@apple.com>
+
+        [iOS WK2] Hash table assertion closing a tab
+        https://bugs.webkit.org/show_bug.cgi?id=131640
+
+        Reviewed by Tim Horton.
+        
+        Have RemoteLayerTreeContext keep track of all PlatformCALayerRemotes,
+        and clear their context pointer when it is being destroyed to avoid
+        calling into a deleted object later.
+
+        * WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
+        (WebKit::PlatformCALayerRemote::~PlatformCALayerRemote):
+        (WebKit::PlatformCALayerRemote::addAnimationForKey):
+        * WebProcess/WebPage/mac/PlatformCALayerRemote.h:
+        (WebKit::PlatformCALayerRemote::clearContext):
+        * WebProcess/WebPage/mac/RemoteLayerTreeContext.h:
+        * WebProcess/WebPage/mac/RemoteLayerTreeContext.mm:
+        (WebKit::RemoteLayerTreeContext::~RemoteLayerTreeContext):
+        (WebKit::RemoteLayerTreeContext::layerWasCreated):
+        (WebKit::RemoteLayerTreeContext::layerWillBeDestroyed):
+
 2014-04-14  Tim Horton  <timothy_horton@apple.com>
 
         Allow dynamic changes of WKThumbnailView snapshot scale
index 535877f..ff879dc 100644 (file)
@@ -109,7 +109,9 @@ PlatformCALayerRemote::~PlatformCALayerRemote()
 {
     for (const auto& layer : m_children)
         toPlatformCALayerRemote(layer.get())->m_superlayer = nullptr;
-    m_context->layerWillBeDestroyed(this);
+
+    if (m_context)
+        m_context->layerWillBeDestroyed(this);
 }
 
 void PlatformCALayerRemote::recursiveBuildTransaction(RemoteLayerTreeTransaction& transaction)
@@ -286,8 +288,9 @@ void PlatformCALayerRemote::addAnimationForKey(const String& key, PlatformCAAnim
 {
     m_properties.addedAnimations.set(key, toPlatformCAAnimationRemote(animation)->properties());
     m_properties.notePropertiesChanged(RemoteLayerTreeTransaction::AnimationsChanged);
-    
-    m_context->willStartAnimationOnLayer(this);
+
+    if (m_context)
+        m_context->willStartAnimationOnLayer(this);
 }
 
 void PlatformCALayerRemote::removeAnimationForKey(const String& key)
index 86fd93f..6531e46 100644 (file)
@@ -153,6 +153,8 @@ public:
 
     RemoteLayerTreeTransaction::LayerProperties& properties() { return m_properties; }
 
+    void clearContext() { m_context = nullptr; }
+
 protected:
     PlatformCALayerRemote(WebCore::PlatformCALayer::LayerType, WebCore::PlatformCALayerClient* owner, RemoteLayerTreeContext* context);
     PlatformCALayerRemote(const PlatformCALayerRemote&, WebCore::PlatformCALayerClient*, RemoteLayerTreeContext*);
index 4074e1b..1717fc4 100644 (file)
@@ -71,6 +71,7 @@ private:
     Vector<RemoteLayerTreeTransaction::LayerCreationProperties> m_createdLayers;
     Vector<WebCore::GraphicsLayer::PlatformLayerID> m_destroyedLayers;
 
+    HashMap<WebCore::GraphicsLayer::PlatformLayerID, PlatformCALayerRemote*> m_liveLayers;
     HashMap<WebCore::GraphicsLayer::PlatformLayerID, PlatformCALayerRemote*> m_layersAwaitingAnimationStart;
 
     RemoteLayerBackingStoreCollection m_backingStoreCollection;
index fdac261..b77378a 100644 (file)
@@ -49,6 +49,8 @@ RemoteLayerTreeContext::RemoteLayerTreeContext(WebPage* webPage)
 
 RemoteLayerTreeContext::~RemoteLayerTreeContext()
 {
+    for (auto& layer : m_liveLayers.values())
+        layer->clearContext();
 }
 
 void RemoteLayerTreeContext::layerWasCreated(PlatformCALayerRemote* layer, PlatformCALayer::LayerType type)
@@ -61,10 +63,13 @@ void RemoteLayerTreeContext::layerWasCreated(PlatformCALayerRemote* layer, Platf
         creationProperties.hostingContextID = layer->hostingContextID();
 
     m_createdLayers.append(creationProperties);
+    m_liveLayers.add(layer->layerID(), layer);
 }
 
 void RemoteLayerTreeContext::layerWillBeDestroyed(PlatformCALayerRemote* layer)
 {
+    m_liveLayers.remove(layer->layerID());
+
     ASSERT(!m_destroyedLayers.contains(layer->layerID()));
     m_destroyedLayers.append(layer->layerID());