Bug 136271 - Crashes in ViewGestureController::beginSwipeGesture when swiping in rapid succession
Summary: Crashes in ViewGestureController::beginSwipeGesture when swiping in rapid suc...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Tim Horton
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2014-08-26 16:57 PDT by Tim Horton
Modified: 2014-08-26 17:18 PDT (History)
4 users (show)

See Also:

Attachments
patch (3.17 KB, patch)
2014-08-26 16:59 PDT, Tim Horton 		simon.fraser: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Horton 2014-08-26 16:57:58 PDT 
<rdar://problem/17923694>

It was possible to get into trackSwipeGesture while another swipe was still occurring, because the guard against this happening depended on m_pendingSwipeReason never being set while a swipe was occurring. However, if the very first scroll event had sufficient magnitude, we would still set m_pendingSwipeReason to InsufficientMagnitude, and then *never clear it*, leading to a path around the guard against multiple live swipes. This in turn allowed stale layers in m_liveSwipeLayers, which lead to the crash.
Comment 1 Tim Horton 2014-08-26 16:59:15 PDT 
Created attachment 237183 [details]
patch
Comment 2 Tim Horton 2014-08-26 16:59:33 PDT 
Comment on attachment 237183 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=237183&action=review

> Source/WebKit2/ChangeLog:4
> +        Need the bug URL (OOPS!).

Gotta fill this in.
Comment 3 WebKit Commit Bot 2014-08-26 17:00:12 PDT 
Attachment 237183 [details] did not pass style-queue:


ERROR: Source/WebKit2/ChangeLog:1:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
Total errors found: 1 in 2 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 4 Tim Horton 2014-08-26 17:18:19 PDT 
http://trac.webkit.org/changeset/172988