136271 2014-08-26 16:57:58 -0700 Crashes in ViewGestureController::beginSwipeGesture when swiping in rapid succession 2014-08-26 17:18:19 -0700 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 thorton thorton commit-queue mitz sam simon.fraser oldest_to_newest 1031517 0 thorton 2014-08-26 16:57:58 -0700 <rdar://problem/17923694> It was possible to get into trackSwipeGesture while another swipe was still occurring, because the guard against this happening depended on m_pendingSwipeReason never being set while a swipe was occurring. However, if the very first scroll event had sufficient magnitude, we would still set m_pendingSwipeReason to InsufficientMagnitude, and then *never clear it*, leading to a path around the guard against multiple live swipes. This in turn allowed stale layers in m_liveSwipeLayers, which lead to the crash. 1031518 1 237183 thorton 2014-08-26 16:59:15 -0700 Created attachment 237183 patch 1031519 2 237183 thorton 2014-08-26 16:59:33 -0700 Comment on attachment 237183 patch View in context: https://bugs.webkit.org/attachment.cgi?id=237183&action=review > Source/WebKit2/ChangeLog:4 > + Need the bug URL (OOPS!). Gotta fill this in. 1031520 3 commit-queue 2014-08-26 17:00:12 -0700 Attachment 237183 did not pass style-queue: ERROR: Source/WebKit2/ChangeLog:1: ChangeLog entry has no bug number [changelog/bugnumber] [5] Total errors found: 1 in 2 files If any of these errors are false positives, please file a bug against check-webkit-style. 1031529 4 thorton 2014-08-26 17:18:19 -0700 http://trac.webkit.org/changeset/172988 237183 2014-08-26 16:59:15 -0700 2014-08-26 17:12:28 -0700 patch swipecrash.diff text/plain 3243 thorton ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQyL0No YW5nZUxvZwppbmRleCBkZDA2NTYxLi5iNGU3MDRkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 Mi9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMzEg QEAKKzIwMTQtMDgtMjYgIFRpbSBIb3J0b24gIDx0aW1vdGh5X2hvcnRvbkBhcHBsZS5jb20+CisK KyAgICAgICAgQ3Jhc2hlcyBpbiBWaWV3R2VzdHVyZUNvbnRyb2xsZXI6OmJlZ2luU3dpcGVHZXN0 dXJlIHdoZW4gc3dpcGluZyBpbiByYXBpZCBzdWNjZXNzaW9uCisgICAgICAgIE5lZWQgdGhlIGJ1 ZyBVUkwgKE9PUFMhKS4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzE3OTIzNjk0PgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEl0IHdhcyBwb3NzaWJs ZSB0byBnZXQgaW50byB0cmFja1N3aXBlR2VzdHVyZSB3aGlsZSBhbm90aGVyIHN3aXBlIHdhcyBz dGlsbAorICAgICAgICBvY2N1cnJpbmcsIGJlY2F1c2UgdGhlIGd1YXJkIGFnYWluc3QgdGhpcyBo YXBwZW5pbmcgZGVwZW5kZWQgb24gbV9wZW5kaW5nU3dpcGVSZWFzb24KKyAgICAgICAgbmV2ZXIg YmVpbmcgc2V0IHdoaWxlIGEgc3dpcGUgd2FzIG9jY3VycmluZy4gSG93ZXZlciwgaWYgdGhlIHZl cnkgZmlyc3Qgc2Nyb2xsIGV2ZW50CisgICAgICAgIGhhZCBzdWZmaWNpZW50IG1hZ25pdHVkZSwg d2Ugd291bGQgc3RpbGwgc2V0IG1fcGVuZGluZ1N3aXBlUmVhc29uIHRvIEluc3VmZmljaWVudE1h Z25pdHVkZSwKKyAgICAgICAgYW5kIHRoZW4gKm5ldmVyIGNsZWFyIGl0KiwgbGVhZGluZyB0byBh IHBhdGggYXJvdW5kIHRoZSBndWFyZCBhZ2FpbnN0IG11bHRpcGxlIGxpdmUgc3dpcGVzLgorICAg ICAgICBUaGlzIGluIHR1cm4gYWxsb3dlZCBzdGFsZSBsYXllcnMgaW4gbV9saXZlU3dpcGVMYXll cnMsIHdoaWNoIGxlYWQgdG8gdGhlIGNyYXNoLgorCisgICAgICAgICogVUlQcm9jZXNzL21hYy9W aWV3R2VzdHVyZUNvbnRyb2xsZXJNYWMubW06CisgICAgICAgIChXZWJLaXQ6OlZpZXdHZXN0dXJl Q29udHJvbGxlcjo6aGFuZGxlU2Nyb2xsV2hlZWxFdmVudCk6CisgICAgICAgIERvbid0IHVuc2V0 IG1fcGVuZGluZ1N3aXBlUmVhc29uIGJlZm9yZSBjYWxsaW5nIHRyYWNrU3dpcGVHZXN0dXJlOwor ICAgICAgICB0cmFja1N3aXBlR2VzdHVyZSB3aWxsIGRvIGl0IGl0c2VsZi4KKworICAgICAgICBE b24ndCBzZXQgbV9wZW5kaW5nU3dpcGVSZWFzb24gdG8gSW5zdWZmaWNpZW50TWFnbml0dWRlCisg ICAgICAgIGlmIHRoZSBldmVudCBhY3R1YWxseSAqaGFzKiBzdWZmaWNpZW50IG1hZ25pdHVkZSB0 byBzdGFydCBhIHN3aXBlLgorCisgICAgICAgIChXZWJLaXQ6OlZpZXdHZXN0dXJlQ29udHJvbGxl cjo6dHJhY2tTd2lwZUdlc3R1cmUpOgorICAgICAgICBBc3NlcnQgdGhhdCB3ZSBkb24ndCBoYXZl IGFuIGFjdGl2ZSBnZXN0dXJlIHdoaWxlIHN0YXJ0aW5nIGEgc3dpcGUuCisKKyAgICAgICAgUmVz ZXQgbV9wZW5kaW5nU3dpcGVSZWFzb24sIGJlY2F1c2UgdGhlIHN3aXBlIGlzIG5vIGxvbmdlciBw ZW5kaW5nIQorCiAyMDE0LTA4LTI1ICBUaW0gSG9ydG9uICA8dGltb3RoeV9ob3J0b25AYXBwbGUu Y29tPgogCiAgICAgICAgIFJFR1JFU1NJT04gKHIxNzI3NzEpOiBBbWF6b24gcHJvZHVjdCBwYWdl IGJlY29tZXMgdW5yZXNwb25zaXZlIGFmdGVyIHN3aXBpbmcgYmFjayB0byBpdApkaWZmIC0tZ2l0 IGEvU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL21hYy9WaWV3R2VzdHVyZUNvbnRyb2xsZXJNYWMu bW0gYi9Tb3VyY2UvV2ViS2l0Mi9VSVByb2Nlc3MvbWFjL1ZpZXdHZXN0dXJlQ29udHJvbGxlck1h Yy5tbQppbmRleCA2YzdlY2FhLi4wNDFkNTIxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0Mi9V SVByb2Nlc3MvbWFjL1ZpZXdHZXN0dXJlQ29udHJvbGxlck1hYy5tbQorKysgYi9Tb3VyY2UvV2Vi S2l0Mi9VSVByb2Nlc3MvbWFjL1ZpZXdHZXN0dXJlQ29udHJvbGxlck1hYy5tbQpAQCAtMzI0LDcg KzMyNCw2IEBAIGJvb2wgVmlld0dlc3R1cmVDb250cm9sbGVyOjpoYW5kbGVTY3JvbGxXaGVlbEV2 ZW50KE5TRXZlbnQgKmV2ZW50KQogCiAgICAgaWYgKG1fcGVuZGluZ1N3aXBlUmVhc29uID09IFBl bmRpbmdTd2lwZVJlYXNvbjo6SW5zdWZmaWNpZW50TWFnbml0dWRlKSB7CiAgICAgICAgIGlmIChk ZWx0YUlzU3VmZmljaWVudFRvQmVnaW5Td2lwZShldmVudCkpIHsKLSAgICAgICAgICAgIG1fcGVu ZGluZ1N3aXBlUmVhc29uID0gUGVuZGluZ1N3aXBlUmVhc29uOjpOb25lOwogICAgICAgICAgICAg dHJhY2tTd2lwZUdlc3R1cmUoZXZlbnQsIG1fcGVuZGluZ1N3aXBlRGlyZWN0aW9uKTsKICAgICAg ICAgICAgIHJldHVybiB0cnVlOwogICAgICAgICB9CkBAIC0zNDMsOCArMzQyLDggQEAgYm9vbCBW aWV3R2VzdHVyZUNvbnRyb2xsZXI6OmhhbmRsZVNjcm9sbFdoZWVsRXZlbnQoTlNFdmVudCAqZXZl bnQpCiAgICAgICAgIHJldHVybiBmYWxzZTsKICAgICB9CiAKLSAgICBtX3BlbmRpbmdTd2lwZVJl YXNvbiA9IFBlbmRpbmdTd2lwZVJlYXNvbjo6SW5zdWZmaWNpZW50TWFnbml0dWRlOwogICAgIGlm ICghZGVsdGFJc1N1ZmZpY2llbnRUb0JlZ2luU3dpcGUoZXZlbnQpKSB7CisgICAgICAgIG1fcGVu ZGluZ1N3aXBlUmVhc29uID0gUGVuZGluZ1N3aXBlUmVhc29uOjpJbnN1ZmZpY2llbnRNYWduaXR1 ZGU7CiAgICAgICAgIG1fcGVuZGluZ1N3aXBlRGlyZWN0aW9uID0gZGlyZWN0aW9uOwogICAgICAg ICByZXR1cm4gdHJ1ZTsKICAgICB9CkBAIC0zNzUsNiArMzc0LDkgQEAgdm9pZCBWaWV3R2VzdHVy ZUNvbnRyb2xsZXI6OndoZWVsRXZlbnRXYXNOb3RIYW5kbGVkQnlXZWJDb3JlKE5TRXZlbnQgKmV2 ZW50KQogCiB2b2lkIFZpZXdHZXN0dXJlQ29udHJvbGxlcjo6dHJhY2tTd2lwZUdlc3R1cmUoTlNF dmVudCAqZXZlbnQsIFN3aXBlRGlyZWN0aW9uIGRpcmVjdGlvbikKIHsKKyAgICBBU1NFUlQobV9h Y3RpdmVHZXN0dXJlVHlwZSA9PSBWaWV3R2VzdHVyZVR5cGU6Ok5vbmUpOworICAgIG1fcGVuZGlu Z1N3aXBlUmVhc29uID0gUGVuZGluZ1N3aXBlUmVhc29uOjpOb25lOworCiAgICAgbV93ZWJQYWdl UHJveHkucmVjb3JkTmF2aWdhdGlvblNuYXBzaG90KCk7CiAKICAgICBDR0Zsb2F0IG1heFByb2dy ZXNzID0gKGRpcmVjdGlvbiA9PSBTd2lwZURpcmVjdGlvbjo6TGVmdCkgPyAxIDogMDsK