Fix crash due to animationDidEnd called on deallocated RemoteLayerTreeHost

https://bugs.webkit.org/show_bug.cgi?id=148442
<rdar://problem/21609257>

Reviewed by Tim Horton.

A PlatformCAAnimationRemote's backpointer to a deallocated RemoteLayerTreeHost is not
invalidated when its host removes its reference to it.

* UIProcess/mac/RemoteLayerTreeHost.mm:
(WebKit::RemoteLayerTreeHost::layerWillBeRemoved): Invalidate a backpointer from the
    PlatformCAAnimationRemotes to the RemoteLayerTreeHost.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@188991 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 0384925dcc5df6e2a4bacd51a5e46485ba2bd898..2845d9c810de7d50b5fa7f34c991cb4899205e4e 100644 (file)
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,18 @@
+2015-08-26  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Fix crash due to animationDidEnd called on deallocated RemoteLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=148442
+        <rdar://problem/21609257>
+
+        Reviewed by Tim Horton.
+
+        A PlatformCAAnimationRemote's backpointer to a deallocated RemoteLayerTreeHost is not
+        invalidated when its host removes its reference to it.
+
+        * UIProcess/mac/RemoteLayerTreeHost.mm:
+        (WebKit::RemoteLayerTreeHost::layerWillBeRemoved): Invalidate a backpointer from the
+            PlatformCAAnimationRemotes to the RemoteLayerTreeHost.
+
 2015-08-26  Beth Dakin  <bdakin@apple.com>
 
         REGRESSION: Safari navigates after a cancelled force click

diff --git a/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm b/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm
index 47d4963522025278d438141f3e1028899e2bc9eb..bfa984b98e578cc32b0c3411b4d63c3f61be4ede 100644 (file)
--- a/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm
+++ b/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm
@@ -138,7 +138,11 @@ LayerOrView *RemoteLayerTreeHost::getLayer(GraphicsLayer::PlatformLayerID layerI
 
 void RemoteLayerTreeHost::layerWillBeRemoved(WebCore::GraphicsLayer::PlatformLayerID layerID)
 {
-    m_animationDelegates.remove(layerID);
+    auto iter = m_animationDelegates.find(layerID);
+    if (iter != m_animationDelegates.end()) {
+        [iter->value invalidate];
+        m_animationDelegates.remove(iter);
+    }
     m_layers.remove(layerID);
 }