Bug 18801 - Safari Crash in RenderLayer::paintLayer when using Unity plugin
Summary: Safari Crash in RenderLayer::paintLayer when using Unity plugin
Status: UNCONFIRMED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.4
: P2 Major
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2008-04-29 11:46 PDT by Mark
Modified: 2008-04-29 15:13 PDT (History)
1 user (show)

See Also:


Attachments
Crash log from browser. (28.90 KB, text/plain)
2008-04-29 11:49 PDT, Mark
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mark 2008-04-29 11:46:36 PDT
Safari crashed in RenderLayer::paintLayer while using the Unity plugin.
While debugging the crash on Mac OS 10.4, I made the following change:
[code]
--- WebCore/rendering/RenderLayer.cpp   (revision 32516)
+++ WebCore/rendering/RenderLayer.cpp   (working copy)
@@ -1621,9 +1621,19 @@
             it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot);
     
     // Now walk the sorted list of children with positive z-indices.
+    /*
     if (m_posZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_posZOrderList->begin(); it != m_posZOrderList->end(); ++it)
             it[0]->paintLayer(rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot);
+    */
+    if( m_posZOrderList )
+    {
+        for( unsigned int i=0; i<m_posZOrderList->size(); ++i )
+        {
+            RenderLayer *rl = m_posZOrderList->at( i );
+            rl->paintLayer( rootLayer, p, paintDirtyRect, haveTransparency, paintRestriction, paintingRoot );
+        }
+    }
     
     if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         setClip(p, paintDirtyRect, damageRect);
[/code]

For some reason moving from the WTF::Vector iterator to walking the array by index fixed the problem. Dunno about you, but that worries me.

The plugin also seems to trigger a lot of ASSERTS in WebCore when the plugin performs callbacks to JS/etc.

For access to page and steps to repro, please contact rick.lee-morang@justleapin.com (reference ticket #993)
Comment 1 Mark 2008-04-29 11:49:59 PDT
Created attachment 20891 [details]
Crash log from browser.

Attached is the crash dump from Safari.
Comment 2 Mark Rowe (bdash) 2008-04-29 15:12:40 PDT
The fact that changing to iterate by index rather than using an iterator prevents the crash could be a sign that m_posZOrderList is being mutated during the loop.

What is the plugin that you refer to, and what steps need to be followed to reproduce the crash?
Comment 3 Mark Rowe (bdash) 2008-04-29 15:12:59 PDT
<rdar://problem/5898876>