Crash in TileController::tileRevalidationTimerFired

https://bugs.webkit.org/show_bug.cgi?id=131656
<rdar://problem/16583166>

Reviewed by Sam Weinig.

It's possible for the TileController revalidation timer to fire after
the GraphicsLayer has been destroyed, so the PlatformCALayer no longer
has an owningGraphicsLayer.

Bail from the timer callback if owningGraphicsLayer() is null.

Also some drive-by 0 -> nullptr changes.

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::willBeDestroyed):
* platform/graphics/ca/PlatformCALayer.cpp:
(WebCore::PlatformCALayer::~PlatformCALayer):
* platform/graphics/ca/mac/TileController.mm:
(WebCore::TileController::tileRevalidationTimerFired):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167290 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 467933fe0b52ace76fc65d9604d23fa388a4dec3..df192eb25437a00ea81105b35bea24ed74ad3d52 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,26 @@
+2014-04-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Crash in TileController::tileRevalidationTimerFired
+        https://bugs.webkit.org/show_bug.cgi?id=131656
+        <rdar://problem/16583166>
+
+        Reviewed by Sam Weinig.
+
+        It's possible for the TileController revalidation timer to fire after
+        the GraphicsLayer has been destroyed, so the PlatformCALayer no longer
+        has an owningGraphicsLayer.
+        
+        Bail from the timer callback if owningGraphicsLayer() is null.
+        
+        Also some drive-by 0 -> nullptr changes.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::willBeDestroyed):
+        * platform/graphics/ca/PlatformCALayer.cpp:
+        (WebCore::PlatformCALayer::~PlatformCALayer):
+        * platform/graphics/ca/mac/TileController.mm:
+        (WebCore::TileController::tileRevalidationTimerFired):
+
 2014-04-14  Bem Jones-Bey  <bjonesbe@adobe.com>
 
         [CSS Shapes] Remove some leftover shape-inside code

diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index 47673093d2f85fffd233685f1a5d8313ce0456bf..b5588517e8dd6525980642c4e3a350179736cce5 100644 (file)
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -387,19 +387,19 @@ void GraphicsLayerCA::willBeDestroyed()
     // We release our references to the PlatformCALayers here, but do not actively unparent them,
     // since that will cause a commit and break our batched commit model. The layers will
     // get released when the rootmost modified GraphicsLayerCA rebuilds its child layers.
-    
+
     // Clean up the layer.
     if (m_layer)
-        m_layer->setOwner(0);
+        m_layer->setOwner(nullptr);
     
     if (m_contentsLayer)
-        m_contentsLayer->setOwner(0);
+        m_contentsLayer->setOwner(nullptr);
 
     if (m_contentsClippingLayer)
-        m_contentsClippingLayer->setOwner(0);
+        m_contentsClippingLayer->setOwner(nullptr);
         
     if (m_structuralLayer)
-        m_structuralLayer->setOwner(0);
+        m_structuralLayer->setOwner(nullptr);
     
     removeCloneLayers();
 

diff --git a/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp b/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp
index 836a3d244495a263a4b470b6ae18e38a012947f4..e3e818de992ffce1e06c36d3770b837a6a969843 100644 (file)
--- a/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp
+++ b/Source/WebCore/platform/graphics/ca/PlatformCALayer.cpp
@@ -47,7 +47,7 @@ PlatformCALayer::~PlatformCALayer()
 {
     // Clear the owner, which also clears it in the delegate to prevent attempts
     // to use the GraphicsLayerCA after it has been destroyed.
-    setOwner(0);
+    setOwner(nullptr);
 }
 
 }

diff --git a/Source/WebCore/platform/graphics/ca/mac/TileController.mm b/Source/WebCore/platform/graphics/ca/mac/TileController.mm
index b7797881246c30c6f4ebc46c0da9b85b5851cd3f..f4022160ce2f89bc85c5738f65bfe4ea6099863d 100644 (file)
--- a/Source/WebCore/platform/graphics/ca/mac/TileController.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileController.mm
@@ -340,6 +340,9 @@ bool TileController::shouldTemporarilyRetainTileCohorts() const
 
 void TileController::tileRevalidationTimerFired(Timer<TileController>*)
 {
+    if (!owningGraphicsLayer())
+        return;
+
     if (m_isInWindow) {
         setNeedsRevalidateTiles();
         return;