Bug 33863 – Occasional crash when interacting with page with reflected WebGL

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Simon Fraser (smfr)]

There's an issue where compositing layers for a reflection can be torn down, without clearing the original layer's replicaLayer pointer.

[Simon Fraser (smfr)]

Created attachment 46949 [details]
Patch

Comment on attachment 46949 [details]
Patch

>          if (layer->backing()) {
> +            // If we're removing backing on a reflection, clear the source GraphicsLayer's pointer to
> +            // its replica GraphicsLayer. In practise this should never happen

So can we add an assertion?

> +            if (layer->isReflection()) {
> +                RenderLayer* sourceLayer = toRenderBoxModelObject(layer->renderer()->parent())->layer();
> +                if (RenderLayerBacking* backing = sourceLayer->backing())
> +                    backing->graphicsLayer()->setReplicatedByLayer(0);

And also assert right before here that the graphicsLayer currently thinks that it’s replicated by our layer?

r=me

[Simon Fraser (smfr)]

http://trac.webkit.org/changeset/53507

[Simon Fraser (smfr)]

http://trac.webkit.org/changeset/53507