Bug 136271 - Crashes in ViewGestureController::beginSwipeGesture when swiping in rapid succession
Summary: Crashes in ViewGestureController::beginSwipeGesture when swiping in rapid suc...
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Tim Horton
Keywords: InRadar
Depends on:
Reported: 2014-08-26 16:57 PDT by Tim Horton
Modified: 2014-08-26 17:18 PDT (History)
4 users (show)

See Also:

patch (3.17 KB, patch)
2014-08-26 16:59 PDT, Tim Horton
simon.fraser: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Horton 2014-08-26 16:57:58 PDT

It was possible to get into trackSwipeGesture while another swipe was still occurring, because the guard against this happening depended on m_pendingSwipeReason never being set while a swipe was occurring. However, if the very first scroll event had sufficient magnitude, we would still set m_pendingSwipeReason to InsufficientMagnitude, and then *never clear it*, leading to a path around the guard against multiple live swipes. This in turn allowed stale layers in m_liveSwipeLayers, which lead to the crash.
Comment 1 Tim Horton 2014-08-26 16:59:15 PDT
Created attachment 237183 [details]
Comment 2 Tim Horton 2014-08-26 16:59:33 PDT
Comment on attachment 237183 [details]

View in context: https://bugs.webkit.org/attachment.cgi?id=237183&action=review

> Source/WebKit2/ChangeLog:4
> +        Need the bug URL (OOPS!).

Gotta fill this in.
Comment 3 WebKit Commit Bot 2014-08-26 17:00:12 PDT
Attachment 237183 [details] did not pass style-queue:

ERROR: Source/WebKit2/ChangeLog:1:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
Total errors found: 1 in 2 files

If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 4 Tim Horton 2014-08-26 17:18:19 PDT