Title: [118627] trunk/Source/WebKit/blackberry
Revision
118627
Author
[email protected]
Date
2012-05-27 07:54:52 -0700 (Sun, 27 May 2012)

Log Message

[BlackBerry] Crash when deleting WebPageCompositor
https://bugs.webkit.org/show_bug.cgi?id=87589

Patch by Arvid Nilsson <[email protected]> on 2012-05-27
Reviewed by Rob Buis.

The WebPageCompositorPrivate is reference counted, so it may outlive
either the WebPage or the WebPageCompositor, depending on who releases
its reference first.

Fixed by disconnecting the objects properly, regardless of who goes
away first.

Reviewed internally by Mike Lattanzio.

PR #156444

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPagePrivate::setCompositor):
(BlackBerry::WebKit::WebPagePrivate::destroyCompositor):
* Api/WebPageCompositor.cpp:
(BlackBerry::WebKit::WebPageCompositor::~WebPageCompositor):
(BlackBerry::WebKit::WebPageCompositor::client):
* Api/WebPageCompositor_p.h:
(BlackBerry::WebKit::WebPageCompositorPrivate::setPage):

Modified Paths

Diff

Modified: trunk/Source/WebKit/blackberry/Api/WebPage.cpp (118626 => 118627)


--- trunk/Source/WebKit/blackberry/Api/WebPage.cpp	2012-05-27 14:41:43 UTC (rev 118626)
+++ trunk/Source/WebKit/blackberry/Api/WebPage.cpp	2012-05-27 14:54:52 UTC (rev 118627)
@@ -5630,6 +5630,8 @@
     }
 
     m_compositor = compositor;
+    if (m_compositor)
+        m_compositor->setPage(this);
 
     // The previous compositor, if any, has now released it's OpenGL resources,
     // so we can safely free the owned context, if any.
@@ -5862,6 +5864,9 @@
     if (!m_ownedContext)
         return;
 
+    // m_compositor is a RefPtr, so it may live on beyond this point.
+    // Disconnect the compositor from us
+    m_compositor->setPage(0);
     m_compositor.clear();
     m_ownedContext.clear();
 }

Modified: trunk/Source/WebKit/blackberry/Api/WebPageCompositor.cpp (118626 => 118627)


--- trunk/Source/WebKit/blackberry/Api/WebPageCompositor.cpp	2012-05-27 14:41:43 UTC (rev 118626)
+++ trunk/Source/WebKit/blackberry/Api/WebPageCompositor.cpp	2012-05-27 14:54:52 UTC (rev 118627)
@@ -190,14 +190,16 @@
 {
     using namespace BlackBerry::Platform;
 
-    webKitThreadMessageClient()->dispatchMessage(createMethodCallMessage(&WebPagePrivate::setCompositor, d->page(), PassRefPtr<WebPageCompositorPrivate>(0)));
+    // If we're being destroyed before the page, send a message to disconnect us
+    if (d->page())
+        webKitThreadMessageClient()->dispatchMessage(createMethodCallMessage(&WebPagePrivate::setCompositor, d->page(), PassRefPtr<WebPageCompositorPrivate>(0)));
     d->compositorDestroyed();
     d->deref();
 }
 
 WebPageCompositorClient* WebPageCompositor::client() const
 {
-    return 0;
+    return d->client();
 }
 
 void WebPageCompositor::prepareFrame(Platform::Graphics::GLES2Context* context, double timestamp)

Modified: trunk/Source/WebKit/blackberry/Api/WebPageCompositor_p.h (118626 => 118627)


--- trunk/Source/WebKit/blackberry/Api/WebPageCompositor_p.h	2012-05-27 14:41:43 UTC (rev 118626)
+++ trunk/Source/WebKit/blackberry/Api/WebPageCompositor_p.h	2012-05-27 14:54:52 UTC (rev 118627)
@@ -82,6 +82,7 @@
     void releaseLayerResources();
 
     WebPagePrivate* page() const { return m_webPage; }
+    void setPage(WebPagePrivate* page) { m_webPage = page; }
     WebPageCompositorClient* client() const { return m_client; }
     void compositorDestroyed();
 

Modified: trunk/Source/WebKit/blackberry/ChangeLog (118626 => 118627)


--- trunk/Source/WebKit/blackberry/ChangeLog	2012-05-27 14:41:43 UTC (rev 118626)
+++ trunk/Source/WebKit/blackberry/ChangeLog	2012-05-27 14:54:52 UTC (rev 118627)
@@ -1,5 +1,32 @@
 2012-05-27  Arvid Nilsson  <[email protected]>
 
+        [BlackBerry] Crash when deleting WebPageCompositor
+        https://bugs.webkit.org/show_bug.cgi?id=87589
+
+        Reviewed by Rob Buis.
+
+        The WebPageCompositorPrivate is reference counted, so it may outlive
+        either the WebPage or the WebPageCompositor, depending on who releases
+        its reference first.
+
+        Fixed by disconnecting the objects properly, regardless of who goes
+        away first.
+
+        Reviewed internally by Mike Lattanzio.
+
+        PR #156444
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setCompositor):
+        (BlackBerry::WebKit::WebPagePrivate::destroyCompositor):
+        * Api/WebPageCompositor.cpp:
+        (BlackBerry::WebKit::WebPageCompositor::~WebPageCompositor):
+        (BlackBerry::WebKit::WebPageCompositor::client):
+        * Api/WebPageCompositor_p.h:
+        (BlackBerry::WebKit::WebPageCompositorPrivate::setPage):
+
+2012-05-27  Arvid Nilsson  <[email protected]>
+
         2012-04-18  Arvid Nilsson  <[email protected]>
 
         [BlackBerry] BackingStore accesses tiles even though it's not active
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to