53198 2011-01-26 15:25:20 -0800 [chromium] Tiled compositor crashes if compositing turned off mid-paint 2011-01-27 16:50:45 -0800 1 1 1 Unclassified WebKit WebKit Misc. 528+ (Nightly build) Other OS X 10.5 RESOLVED FIXED P2 Normal --- 1 enne enne commit-queue enne jamesr kbr vangelis oldest_to_newest 340517 0 enne 2011-01-26 15:25:20 -0800 [chromium] Tiled compositor crashes if compositing turned off mid-paint 340519 1 80247 enne 2011-01-26 15:26:58 -0800 Created attachment 80247 Patch 340521 2 enne 2011-01-26 15:31:25 -0800 In some cases a paint operation causes layout, which causes the root layer to no longer be composited, which turns off compositing mid-composite. This patch adds a few checks to be robust to this. Tested by adding a layerRenderer()->setRootLayer(NULL) in the middle of the LayerTilerChromium::update after painting. There's a flash of "compositor blue" as the page switches from the compositor back to software, but it behaves correctly. Future changes to separate out the compositor into a separate thread won't have this behavior. See: http://crbug.com/69161 340529 3 80247 jamesr 2011-01-26 15:43:50 -0800 Comment on attachment 80247 Patch Good catch! R=me. We (in the general sense of "we") should experiment with sublayers as well to make sure they handle this case. 340551 4 enne 2011-01-26 16:10:35 -0800 (In reply to comment #3) > (From update of attachment 80247 [details]) > Good catch! R=me. > > We (in the general sense of "we") should experiment with sublayers as well to make sure they handle this case. Hmm. By code inspection, LayerRendererChromium::updateLayersRecursive appears to insert naked pointers to LayerChromium objects into a Vector that it uses over the course of update/draw. If a paint call ends up deleting a child layer (maybe by deleting the owning GraphicsLayer?), then the draw pass could traverse into bogus memory. That looks like the only possibility for bad behavior, but I don't know enough about the lifetime of GraphicsLayer or LayerChromium objects to know if that's possible during a paint call. 341128 5 80247 commit-queue 2011-01-27 16:50:42 -0800 Comment on attachment 80247 Patch Clearing flags on attachment: 80247 Committed r76864: <http://trac.webkit.org/changeset/76864> 341129 6 commit-queue 2011-01-27 16:50:45 -0800 All reviewed patches have been landed. Closing bug. 80247 2011-01-26 15:26:58 -0800 2011-01-27 16:50:42 -0800 Patch bug-53198-20110126152657.patch text/plain 2955 enne ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBlNzA0NzYwNWVkNzE0Mjc2YTYxOGU0NjY1ZjdjYjg0MmZjNmZhOWZlLi5h YTk4YmFjZjQ1YmZiYzRiMjI5MWVhM2I5ZDdlMDI1OGM3ZDA1OGY0IDEwMDY0NAotLS0gYS9Tb3Vy Y2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0x LDMgKzEsMTYgQEAKKzIwMTEtMDEtMjYgIEFkcmllbm5lIFdhbGtlciAgPGVubmVAZ29vZ2xlLmNv bT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBbY2hy b21pdW1dIFRpbGVkIGNvbXBvc2l0b3IgY3Jhc2hlcyBpZiBjb21wb3NpdGluZyB0dXJuZWQgb2Zm IG1pZC1wYWludAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9NTMxOTgKKworICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0xheWVyUmVu ZGVyZXJDaHJvbWl1bS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpMYXllclJlbmRlcmVyQ2hyb21p dW06OmRyYXdMYXllcnMpOgorICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0xh eWVyVGlsZXJDaHJvbWl1bS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpMYXllclRpbGVyQ2hyb21p dW06OnVwZGF0ZSk6CisgICAgICAgIChXZWJDb3JlOjpMYXllclRpbGVyQ2hyb21pdW06OmRyYXcp OgorCiAyMDExLTAxLTI2ICBaYWxhbiBCdWp0YXMgPHpidWp0YXNAZ21haWwuY29tPgogCiAgICAg ICAgIFJldmlld2VkIGJ5IEFuZHJlYXMgS2xpbmcuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y ZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclJlbmRlcmVyQ2hyb21pdW0uY3BwIGIv U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vTGF5ZXJSZW5kZXJlckNo cm9taXVtLmNwcAppbmRleCA2MDFmMTNjMTE4NGIwYzI4NzQ0NGNlMzgxYjg4NjIzNGVjYTMwZDcx Li5jMmFjY2ZkMWMxNWNkNGM5ZTBiMDcxMTczOWY5ZTEyM2NkMGIyNGMzIDEwMDY0NAotLS0gYS9T b3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclJlbmRlcmVyQ2hy b21pdW0uY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVt L0xheWVyUmVuZGVyZXJDaHJvbWl1bS5jcHAKQEAgLTI2NSw2ICsyNjUsMTEgQEAgdm9pZCBMYXll clJlbmRlcmVyQ2hyb21pdW06OmRyYXdMYXllcnMoY29uc3QgSW50UmVjdCYgdmlzaWJsZVJlY3Qs IGNvbnN0IEludFJlY3QKICAgICAvLyBSZS1lbmFibGUgY29sb3Igd3JpdGVzIHRvIGxheWVycywg d2hpY2ggbWF5IGJlIHBhcnRpYWxseSB0cmFuc3BhcmVudC4KICAgICBtX2NvbnRleHQtPmNvbG9y TWFzayh0cnVlLCB0cnVlLCB0cnVlLCB0cnVlKTsKIAorICAgIC8vIFJlY2hlY2sgdGhhdCB3ZSBz dGlsbCBoYXZlIGEgcm9vdCBsYXllci4gIFRoaXMgbWF5IGJlY29tZSBudWxsIGlmCisgICAgLy8g Y29tcG9zaXRpbmcgZ2V0cyB0dXJuZWQgb2ZmIGR1cmluZyBhIHBhaW50IG9wZXJhdGlvbi4KKyAg ICBpZiAoIW1fcm9vdExheWVyKQorICAgICAgICByZXR1cm47CisKICAgICAvLyBTZXQgdGhlIHJv b3QgdmlzaWJsZS9jb250ZW50IHJlY3RzIC0tLSB1c2VkIGJ5IHN1YnNlcXVlbnQgZHJhd0xheWVy cyBjYWxscy4KICAgICBtX3Jvb3RWaXNpYmxlUmVjdCA9IHZpc2libGVSZWN0OwogICAgIG1fcm9v dENvbnRlbnRSZWN0ID0gY29udGVudFJlY3Q7CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9w bGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclRpbGVyQ2hyb21pdW0uY3BwIGIvU291cmNl L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vTGF5ZXJUaWxlckNocm9taXVtLmNw cAppbmRleCA2YjY1ZTY2OTQ4NWUwZTdiYmRlZmU4NTVhNmYwNTM0OTRiZDg3ZDdlLi4zYjE3OWI2 ZDM0Mzc2N2ExZWI1ZTM0MGQ3ODIyY2M0OTc3ODg2NGIzIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi Q29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9MYXllclRpbGVyQ2hyb21pdW0uY3BwCisr KyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0xheWVyVGlsZXJD aHJvbWl1bS5jcHAKQEAgLTI5OSw2ICsyOTksMTAgQEAgdm9pZCBMYXllclRpbGVyQ2hyb21pdW06 OnVwZGF0ZShUaWxlUGFpbnRJbnRlcmZhY2UmIHBhaW50ZXIsIGNvbnN0IEludFJlY3QmIGNvbnQK ICNlcnJvciAiTmVlZCB0byBpbXBsZW1lbnQgZm9yIHlvdXIgcGxhdGZvcm0uIgogI2VuZGlmCiAK KyAgICAvLyBQYWludGluZyBjb3VsZCBjYXVzZSBjb21wb3NpdGluZyB0byBnZXQgdHVybmVkIG9m Ziwgd2hpY2ggbWF5IGNhdXNlIHRoZSB0aWxlciB0byBiZWNvbWUgaW52YWxpZGF0ZWQgbWlkLXVw ZGF0ZS4KKyAgICBpZiAoIW1fdGlsZXMuc2l6ZSgpKQorICAgICAgICByZXR1cm47CisKICAgICBm b3IgKGludCBqID0gdG9wOyBqIDw9IGJvdHRvbTsgKytqKSB7CiAgICAgICAgIGZvciAoaW50IGkg PSBsZWZ0OyBpIDw9IHJpZ2h0OyArK2kpIHsKICAgICAgICAgICAgIFRpbGUqIHRpbGUgPSBtX3Rp bGVzW3RpbGVJbmRleChpLCBqKV0uZ2V0KCk7CkBAIC0zNTcsNyArMzYxLDcgQEAgdm9pZCBMYXll clRpbGVyQ2hyb21pdW06OnNldExheWVyUG9zaXRpb24oY29uc3QgSW50UG9pbnQmIGxheWVyUG9z aXRpb24pCiAKIHZvaWQgTGF5ZXJUaWxlckNocm9taXVtOjpkcmF3KGNvbnN0IEludFJlY3QmIGNv bnRlbnRSZWN0KQogewotICAgIGlmIChtX3NraXBzRHJhdykKKyAgICBpZiAobV9za2lwc0RyYXcg fHwgIW1fdGlsZXMuc2l6ZSgpKQogICAgICAgICByZXR1cm47CiAKICAgICAvLyBXZSByZXVzZSB0 aGUgc2hhZGVyIHByb2dyYW0gdXNlZCBieSBDb250ZW50TGF5ZXJDaHJvbWl1bS4K