Bug 147124 – Fix crash due to RemoteLayerTreeDisplayRefreshMonitor outliving RemoteLayerTreeDrawingArea

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Wenson Hsieh]

On occasion, a RemoteLayerTreeDrawingArea may be outlived by one or more of its RemoteLayerTreeDisplayRefreshMonitors. Upon destruction of the RemoteLayerTreeDisplayRefreshMonitor, this may cause the monitor to access a method of its drawing area, which has been deallocated. This results in a crash.

[Wenson Hsieh]

<rdar://problem/21582858>

[Wenson Hsieh]

Created attachment 257135 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 257135 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=257135&action=review

> Source/WebKit2/WebProcess/WebPage/Cocoa/RemoteLayerTreeDisplayRefreshMonitor.mm:78
> +void RemoteLayerTreeDisplayRefreshMonitor::clearDrawingArea()
> +{
> +    m_drawingArea = nullptr;
> +}

You don't need this. The WeakPtr does this for you.

> Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:95
> +    for (RemoteLayerTreeDisplayRefreshMonitor* monitor : m_displayRefreshMonitors)
> +        monitor->clearDrawingArea();

This is not needed.

[Wenson Hsieh]

Comment on attachment 257135 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=257135&action=review

>> Source/WebKit2/WebProcess/WebPage/Cocoa/RemoteLayerTreeDisplayRefreshMonitor.mm:78
>> +}
> 
> You don't need this. The WeakPtr does this for you.

Fixed!

>> Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:95
>> +        monitor->clearDrawingArea();
> 
> This is not needed.

Got it -- fixed!

[Wenson Hsieh]

Created attachment 257139 [details]
Patch

[Wenson Hsieh]

From the ChangeLog: logically, a RemoteLayerTreeDrawingArea should always outlive its refresh monitors. Refer to https://bugs.webkit.org/show_bug.cgi?id=147128 for more details.

[WebKit Commit Bot]

Comment on attachment 257139 [details]
Patch

Clearing flags on attachment: 257139

Committed r187050: <http://trac.webkit.org/changeset/187050>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.