Occasional crash in CoreGraphics when using accelerated compositing in Windows.

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Andy Estes]

When viewing pages rendered in accelerated compositing mode using the Windows port, there is occasionally a crash in the underlying CoreGraphics library used by WebKit on Windows.  Methods to repeat the crash include resizing the browser window, repeatedly changing focus between the browser and another application, and dragging items into the WebView.  The crash appears to be intermittent.

[Andy Estes]

<rdar://problem/7806666>

[Andy Estes]

Diagnosis from Steve Falkenburg:

This CGDataProviderRef pulls its data from m_backingStoreBitmap. Note this is deleted on a timer after a period of inactivity. I'm thinking this may be the cause of the bug. If the m_backingStoreBitmap is freed and then the WKCACFLayerRenderer::renderTimerFired(Timer<WKCACFLayerRenderer>*) timer fires, we will crash. One possible easy fix would be to protect the call to deleteBackingStoreSoon() if isAcceleratedCompositing() returns true in WebView::paint(). I haven't tested this theory (or fix).

[Andy Estes]

Created attachment 54020 [details]
patch

[Andy Estes]

Here is a description of a solution from Adam Roben, which is what I implemented in the patch:

I mentioned to Steve that one way to fix the problem with deleteBackingStoreSoon() is to add a RefCounted wrapper around an HBITMAP, and use that to hold the WebView's backing store bitmap. Then we can ref that wrapper object in updateRootLayerContents and call CGDataProviderCreateWithData (not CreateWithCFData), passing the wrapper object as the info pointer and a function that just calls deref() on the wrapper as the release callback. That should allow the bitmap to live as long as the CGImageRef needs it.

[Maciej Stachowiak]

Comment on attachment 54020 [details]
patch

r=me

Nice fix.

[Andy Estes]

Committed revision 58067.  Thanks Maciej!

[Adam Roben (:aroben)]

Comment on attachment 54020 [details]
patch

Nice fix!