Bug 134117 – Unreproducible crashes under WebCore::ScrollingTree::updateTreeFromStateNode() from messaging a deleted Obj-C object

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Beth Dakin]

There are many unreproducible crashes under WebCore::ScrollingTree::updateTreeFromStateNode() from messaging a deleted Obj-C object. We suspect that we could fix this if ScrollingStateNodes retained their LayerRepresentations. 

<rdar://problem/17149252>

[Beth Dakin]

Created attachment 233446 [details]
Patch

[Tim Horton]

Comment on attachment 233446 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=233446&action=review

> Source/WebCore/page/scrolling/ScrollingStateNode.h:179
> -        PlatformLayer *m_platformLayer;
> +        PlatformLayer* m_platformLayer;

the star was already on the right side

[Beth Dakin]

Created attachment 233447 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 233447 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=233447&action=review

> Source/WebCore/page/scrolling/ScrollingStateNode.h:88
> +    LayerRepresentation(const LayerRepresentation& other)
> +        : m_platformLayer(other.m_platformLayer)
> +        , m_layerID(other.m_layerID)
> +        , m_representation(other.m_representation)

This fails to assign m_graphicsLayer.

> Source/WebCore/page/scrolling/ScrollingStateNode.h:133
> +    LayerRepresentation& operator=(const LayerRepresentation& other)
> +    {
> +        m_platformLayer = other.m_platformLayer;
> +        m_layerID = other.m_layerID;
> +        m_representation = other.m_representation;
> +
> +        if (m_representation == PlatformLayerRepresentation)
> +            retainPlatformLayer(m_platformLayer);
> +
> +        return *this;
> +    }

This fails to copy m_graphicsLayer.

[Beth Dakin]

Thanks, Simon! http://trac.webkit.org/changeset/170224

[Gyuyoung Kim]

(In reply to comment #5)
> Thanks, Simon! http://trac.webkit.org/changeset/170224

I add retainPlatformLayer() and releasePlatformLayer() to EFL port in order to fix a build break since r170224.

http://trac.webkit.org/changeset/170229