Crash in DrawingAreaProxyImpl::paint when WKView paints after being resized while hidden

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Adam Roben (:aroben)]

If WKView is resized while hidden (and you don't run into bug 54141, because it's been fixed), and is then shown and asked to paint, you'll crash inside DrawingAreaProxyImpl::paint due to a null BackingStore. The crashing line is this:

    m_backingStore->paint(context, rect);

m_backingStore is null. Here's the backtrace:

>	WebKit.dll!WTF::OwnPtr<WebKit::BackingStore>::operator->()  Line 66 + 0x35 bytes	C++
 	WebKit.dll!WebKit::DrawingAreaProxyImpl::paint(HDC__ * context=0xaa011176, const WebCore::IntRect & rect={...}, WebKit::Region & unpaintedRegion={...})  Line 83 + 0x13 bytes	C++
 	WebKit.dll!WebKit::WebView::onPaintEvent(HWND__ * hWnd=0x00120418, unsigned int message=15, unsigned int __formal=0, unsigned int __formal=0, bool & handled=true)  Line 427	C++
 	WebKit.dll!WebKit::WebView::wndProc(HWND__ * hWnd=0x00120418, unsigned int message=15, unsigned int wParam=0, long lParam=0)  Line 127 + 0x1c bytes	C++
 	WebKit.dll!WebKit::WebView::WebViewWndProc(HWND__ * hWnd=0x00120418, unsigned int message=15, unsigned int wParam=0, long lParam=0)  Line 97 + 0x18 bytes	C++
 	user32.dll!_InternalCallWinProc@20()  + 0x28 bytes

[Adam Roben (:aroben)]

<rdar://problem/8979365>

[Adam Roben (:aroben)]

Created attachment 81874 [details]
Notice when the backing store goes away after DidSetSize

[Adam Roben (:aroben)]

Committed r78199: <http://trac.webkit.org/changeset/78199>

[Anders Carlsson]

*** Bug 54247 has been marked as a duplicate of this bug. ***