I'm getting a reproducible crash when leaving a page with a windowed plugin. Leaving the page causes the plugin window to be destroyed with the Win32 api function DestroyWindow. This will send a syncrounous WM_PARENTNOTIFY message to the parent, in this case the WebView, see https://msdn.microsoft.com/en-us/library/windows/desktop/ms632682(v=vs.85).aspx. The WebView window procedure will, when processing the WM_PARENTNOTIFY message, call UpdateWindow to paint synchronously. This will cause reentrancy problems, since we're already called from WebCore code, and then reenter WebCore painting code. In this particular case, we crash because we try to paint a deleted RenderLayer.
Created attachment 249108 [details]
An alternative would be to stop UpdateWindow only for the WM_PARENTNOTIFY message, I'm a little worried about drawing performance in that case, though.
Comment on attachment 249108 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=249108&action=review
> + case WM_MOUSEWHEEL:
> + case WM_MOUSEMOVE:
> + case WM_KEYDOWN:
> + case WM_GESTURE:
Where did this set of event types come from? Why not more, or fewer?
(In reply to comment #3)
> Comment on attachment 249108 [details]
> View in context:
> > Source/WebKit/win/WebView.cpp:2526
> > + case WM_MOUSEWHEEL:
> > + case WM_MOUSEMOVE:
> > + case WM_KEYDOWN:
> > + case WM_GESTURE:
> Where did this set of event types come from? Why not more, or fewer?
I had some repaint artifacts when scrolling, that's why I added these. Maybe more are needed, and maybe it would be safest to only avoid UpdateWindow when receiving the WM_PARENTNOTIFY message. In some cases that might lead to unneeded painting, I think.
Created attachment 249409 [details]
Comment on attachment 249409 [details]
Clearing flags on attachment: 249409
Committed r181966: <http://trac.webkit.org/changeset/181966>
All reviewed patches have been landed. Closing bug.