Bug 174106 – Null RenderLayer* deref in FrameView::adjustTiledBackingCoverage()

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Andreas Kling]

<rdar://problem/33085838>

Here's a crash:

0   WebCore                       	0x000000018d5c9ac0 WebCore::FrameView::adjustTiledBackingCoverage() + 56 (/BuildRoot/Applications/Xcode.app/Contents/Developer/Toolchains/iOS11.0.xctoolchain/usr/include/c++/v1/memory:2582)
1   WebCore                       	0x000000018d5c9ab8 WebCore::FrameView::adjustTiledBackingCoverage() + 48 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7604.1.28.1/page/FrameView.cpp:5248)
2   WebCore                       	0x000000018e23f6fc WebCore::Page::setIsVisibleInternal(bool) + 132 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7604.1.28.1/page/Page.cpp:1683)
3   WebCore                       	0x000000018e23e5e0 WebCore::Page::setActivityState(unsigned int) + 72 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7604.1.28.1/page/Page.cpp:1610)
4   CoreFoundation                	0x00000001851e4130 __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 20

Pretty weird that we're called from the event loop with a layer-less RenderView.
I am unable to reproduce this locally, but it looks like we just need to null check the RenderView::layer().

[Andreas Kling]

Created attachment 314528 [details]
Patch

[zalan]

Comment on attachment 314528 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=314528&action=review

> Source/WebCore/ChangeLog:12
> +        I haven't been able to reproduce this crash locally, but I have seen
> +        video of someone who can, so here's a null check for the RenderView::layer()
> +        which could be null if we're called between RenderView construction
> +        and the first callback to RenderLayerModelObject::styleDidChange().

or if we somehow managed to call destroyLayer() on the RenderView (and now we are bringing the FrameView to foreground)

[WebKit Commit Bot]

The commit-queue encountered the following flaky tests while processing attachment 314528 [details]:

editing/spelling/spellcheck-async.html bug 160571 (authors: [e-mail] and [e-mail])
The commit-queue is continuing to process your patch.

[WebKit Commit Bot]

Comment on attachment 314528 [details]
Patch

Clearing flags on attachment: 314528

Committed r219108: <http://trac.webkit.org/changeset/219108>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.