Title: [133578] trunk/Source/WebKit2
Revision
133578
Author
kbal...@webkit.org
Date
2012-11-06 02:46:53 -0800 (Tue, 06 Nov 2012)

Log Message

[CoordinatedGraphics] compositing/iframes/connect-compositing-iframe.html crashes
https://bugs.webkit.org/show_bug.cgi?id=101232

Reviewed by Jocelyn Turcotte.

The crash is happening in CoordinatedGraphicsLayer::flushCompositingState
because we dereferencing a null m_coordinatedGraphicsLayerClient.
This happens when the root layer became composited because it has content overlapping
with an inner iframe that is composited. In this case the RenderLayerCompositor attaches
the layer with RootLayerAttachedViaEnclosingFrame attachment flag and do not call
ChromeClient::attachRootGraphcisLayer so we don't have a chance to set m_coordinatedGraphicsLayerClient.
The solution is to set the client early in the factory method.

* WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
(WebKit::LayerTreeCoordinator::createGraphicsLayer):

Modified Paths

Diff

Modified: trunk/Source/WebKit2/ChangeLog (133577 => 133578)


--- trunk/Source/WebKit2/ChangeLog	2012-11-06 10:43:46 UTC (rev 133577)
+++ trunk/Source/WebKit2/ChangeLog	2012-11-06 10:46:53 UTC (rev 133578)
@@ -1,3 +1,21 @@
+2012-11-06  Balazs Kelemen  <kbal...@webkit.org>
+
+        [CoordinatedGraphics] compositing/iframes/connect-compositing-iframe.html crashes
+        https://bugs.webkit.org/show_bug.cgi?id=101232
+
+        Reviewed by Jocelyn Turcotte.
+
+        The crash is happening in CoordinatedGraphicsLayer::flushCompositingState
+        because we dereferencing a null m_coordinatedGraphicsLayerClient.
+        This happens when the root layer became composited because it has content overlapping
+        with an inner iframe that is composited. In this case the RenderLayerCompositor attaches
+        the layer with RootLayerAttachedViaEnclosingFrame attachment flag and do not call
+        ChromeClient::attachRootGraphcisLayer so we don't have a chance to set m_coordinatedGraphicsLayerClient.
+        The solution is to set the client early in the factory method.
+
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::createGraphicsLayer):
+
 2012-11-06  Viatcheslav Ostapenko  <v.ostape...@samsung.com>
 
         [EFL] [WK2] Random crash in Minibrowser

Modified: trunk/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp (133577 => 133578)


--- trunk/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp	2012-11-06 10:43:46 UTC (rev 133577)
+++ trunk/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp	2012-11-06 10:46:53 UTC (rev 133578)
@@ -580,7 +580,9 @@
 
 PassOwnPtr<GraphicsLayer> LayerTreeCoordinator::createGraphicsLayer(GraphicsLayerClient* client)
 {
-    return adoptPtr(new CoordinatedGraphicsLayer(client));
+    CoordinatedGraphicsLayer* newLayer = new CoordinatedGraphicsLayer(client);
+    newLayer->setCoordinatedGraphicsLayerClient(this);
+    return adoptPtr(newLayer);
 }
 
 bool LayerTreeHost::supportsAcceleratedCompositing()
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to