Bug 198522 - [GTK] Crash when re-entering AC mode after r245957
Summary: [GTK] Crash when re-entering AC mode after r245957
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKitGTK (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
Keywords: Gtk
Depends on:
Reported: 2019-06-04 02:48 PDT by Carlos Garcia Campos
Modified: 2019-06-04 03:04 PDT (History)
3 users (show)

See Also:

Patch (1.85 KB, patch)
2019-06-04 02:51 PDT, Carlos Garcia Campos
zan: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos Garcia Campos 2019-06-04 02:48:54 PDT
When AcceleratedBackingStoreWayland::displayBuffer() is called and we have already left AC mode, we early dispatch the image and release it. The problem is that images are reused, so the given image can be the committed one. In that case we end up freeing it again in the next AcceleratedBackingStoreWayland::paint() call.

Thread 1 "MiniBrowser" received signal SIGSEGV, Segmentation fault.
0x00007fffeccbc497 in wl_list_remove (elm=0x55555563a7e0) at ../src/wayland-util.c:55
55	../src/wayland-util.c: No existe el fichero o el directorio.
(gdb) bt
#0  0x00007fffeccbc497 in wl_list_remove (elm=0x55555563a7e0) at ../src/wayland-util.c:55
#1  0x00007fffec797819 in wpe_fdo_egl_exported_image_destroy(wpe_fdo_egl_exported_image*) () from /home/cgarcia/gnome/lib/libWPEBackend-fdo-1.0.so.1
#2  0x00007fffec7a039c in wpe_view_backend_exportable_fdo_egl_dispatch_release_exported_image () from /home/cgarcia/gnome/lib/libWPEBackend-fdo-1.0.so.1
#3  0x00007ffff51e87a7 in WebKit::AcceleratedBackingStoreWayland::paint(_cairo*, WebCore::IntRect const&) ()
   from /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#4  0x00007ffff51862c8 in webkitWebViewBaseDraw(_GtkWidget*, _cairo*) () from /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
Comment 1 Carlos Garcia Campos 2019-06-04 02:51:07 PDT
Created attachment 371259 [details]
Comment 2 Carlos Garcia Campos 2019-06-04 03:04:26 PDT
Committed r246058: <https://trac.webkit.org/changeset/246058>