Modified: trunk/Source/WebCore/ChangeLog (255334 => 255335)
--- trunk/Source/WebCore/ChangeLog 2020-01-29 03:01:58 UTC (rev 255334)
+++ trunk/Source/WebCore/ChangeLog 2020-01-29 03:09:14 UTC (rev 255335)
@@ -1,3 +1,28 @@
+2020-01-28 Simon Fraser <[email protected]>
+
+ Add logging to detect cause of rare crash at RenderLayer::calculateLayerBounds const
+ https://bugs.webkit.org/show_bug.cgi?id=206915
+ rdar://problem/55699292
+
+ Reviewed by Tim Horton.
+
+ We have reports of a rare crash under RenderLayer::calculateLayerBounds() under RenderLayer::updateLayerPositions(),
+ where a RenderLayerBacking's m_owningLayer is null (which should never happen). This appears to reproduce
+ by clicking links to CNN or FoxNews articles from Google News on macOS.
+
+ Add a bear trap in that offset in the class, and also null-check the m_owningLayer reference
+ in release assertions to better understand what's happening.
+
+ * rendering/RenderLayerBacking.cpp:
+ (WebCore::RenderLayerBacking::~RenderLayerBacking):
+ (WebCore::RenderLayerBacking::willBeDestroyed):
+ (WebCore::RenderLayerBacking::updateCompositedBounds):
+ (WebCore::RenderLayerBacking::updateAfterLayout):
+ (WebCore::RenderLayerBacking::updateConfiguration):
+ (WebCore::RenderLayerBacking::updateAfterDescendants):
+ (WebCore::RenderLayerBacking::paintIntoLayer):
+ * rendering/RenderLayerBacking.h:
+
2020-01-28 Pinki Gyanchandani <[email protected]>
Null deref crash in DOMWindow::scrollBy after evoking updateLayoutIgnorePendingStylesheets()
Modified: trunk/Source/WebCore/rendering/RenderLayerBacking.cpp (255334 => 255335)
--- trunk/Source/WebCore/rendering/RenderLayerBacking.cpp 2020-01-29 03:01:58 UTC (rev 255334)
+++ trunk/Source/WebCore/rendering/RenderLayerBacking.cpp 2020-01-29 03:09:14 UTC (rev 255335)
@@ -238,6 +238,10 @@
RenderLayerBacking::~RenderLayerBacking()
{
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "~RenderLayerBacking: m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "~RenderLayerBacking: m_owningLayer is null (55699292)");
+#endif
// Note that m_owningLayer->backing() is null here.
updateAncestorClipping(false, nullptr);
updateChildClippingStrategy(false);
@@ -258,6 +262,11 @@
void RenderLayerBacking::willBeDestroyed()
{
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "RenderLayerBacking::willBeDestroyed(): m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "RenderLayerBacking::willBeDestroyed(): m_owningLayer is null (55699292)");
+#endif
+
ASSERT(m_owningLayer.backing() == this);
compositor().removeFromScrollCoordinatedLayers(m_owningLayer);
@@ -699,6 +708,11 @@
bool RenderLayerBacking::updateCompositedBounds()
{
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "RenderLayerBacking::updateCompositedBounds(): m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "RenderLayerBacking::updateCompositedBounds(): m_owningLayer is null (55699292)");
+#endif
+
LayoutRect layerBounds = m_owningLayer.calculateLayerBounds(&m_owningLayer, { }, RenderLayer::defaultCalculateLayerBoundsFlags() | RenderLayer::ExcludeHiddenDescendants | RenderLayer::DontConstrainForMask);
// Clip to the size of the document or enclosing overflow-scroll layer.
// If this or an ancestor is transformed, we can't currently compute the correct rect to intersect with.
@@ -790,6 +804,11 @@
void RenderLayerBacking::updateAfterLayout(bool needsClippingUpdate, bool needsFullRepaint)
{
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "RenderLayerBacking::updateAfterLayout(): m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "RenderLayerBacking::updateAfterLayout(): m_owningLayer is null (55699292)");
+#endif
+
LOG(Compositing, "RenderLayerBacking %p updateAfterLayout (layer %p)", this, &m_owningLayer);
// This is the main trigger for layout changing layer geometry, but we have to do the work again in updateBackingAndHierarchy()
@@ -955,6 +974,11 @@
if (layerConfigChanged)
updatePaintingPhases();
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "RenderLayerBacking::updateConfiguration(): m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "RenderLayerBacking::updateConfiguration(): m_owningLayer is null (55699292)");
+#endif
+
return layerConfigChanged;
}
@@ -1432,6 +1456,11 @@
m_scrollContainerLayer->setContentsVisible(renderer().style().visibility() == Visibility::Visible);
m_scrollContainerLayer->setUserInteractionEnabled(renderer().style().pointerEvents() != PointerEvents::None);
}
+
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "RenderLayerBacking::updateAfterDescendants(): m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "RenderLayerBacking::updateAfterDescendants(): m_owningLayer is null (55699292)");
+#endif
}
// FIXME: Avoid repaints when clip path changes.
@@ -2787,6 +2816,11 @@
const IntRect& paintDirtyRect, // In the coords of rootLayer.
OptionSet<PaintBehavior> paintBehavior, EventRegionContext* eventRegionContext)
{
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "RenderLayerBacking::paintIntoLayer(): m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "RenderLayerBacking::paintIntoLayer(): m_owningLayer is null (55699292)");
+#endif
+
if ((paintsIntoWindow() || paintsIntoCompositedAncestor()) && graphicsLayer->paintingPhase() != OptionSet<GraphicsLayerPaintingPhase>(GraphicsLayerPaintingPhase::ChildClippingMask)) {
#if !PLATFORM(IOS_FAMILY) && !OS(WINDOWS)
// FIXME: Looks like the CALayer tree is out of sync with the GraphicsLayer heirarchy
@@ -2857,6 +2891,11 @@
if (!eventRegionContext)
compositor().didPaintBacking(this);
+
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ RELEASE_ASSERT_WITH_MESSAGE(m_owningLayerBearTrap == BEAR_TRAP_VALUE, "RenderLayerBacking::paintIntoLayer() end: m_owningLayerBearTrap caught the bear (55699292)");
+ RELEASE_ASSERT_WITH_MESSAGE(&m_owningLayer, "RenderLayerBacking::paintIntoLayer() end: m_owningLayer is null (55699292)");
+#endif
}
OptionSet<RenderLayer::PaintLayerFlag> RenderLayerBacking::paintFlagsForLayer(const GraphicsLayer& graphicsLayer) const
Modified: trunk/Source/WebCore/rendering/RenderLayerBacking.h (255334 => 255335)
--- trunk/Source/WebCore/rendering/RenderLayerBacking.h 2020-01-29 03:01:58 UTC (rev 255334)
+++ trunk/Source/WebCore/rendering/RenderLayerBacking.h 2020-01-29 03:09:14 UTC (rev 255335)
@@ -42,6 +42,15 @@
class TiledBacking;
class TransformationMatrix;
+
+#if __WORDSIZE == 64
+#define USE_OWNING_LAYER_BEAR_TRAP 1
+#define BEAR_TRAP_VALUE 0xEEEEEEEEEEEEEEEE
+#else
+#define USE_OWNING_LAYER_BEAR_TRAP 0
+#endif
+
+
enum CompositingLayerType {
NormalCompositingLayer, // non-tiled layer with backing store
TiledCompositingLayer, // tiled layer (always has backing store)
@@ -389,6 +398,9 @@
LayoutRect computeParentGraphicsLayerRect(const RenderLayer* compositedAncestor) const;
LayoutRect computePrimaryGraphicsLayerRect(const RenderLayer* compositedAncestor, const LayoutRect& parentGraphicsLayerRect) const;
+#if USE(OWNING_LAYER_BEAR_TRAP)
+ uintptr_t m_owningLayerBearTrap { BEAR_TRAP_VALUE }; // webkit.org/b.206915
+#endif
RenderLayer& m_owningLayer;
// A list other layers that paint into this backing store, later than m_owningLayer in paint order.
