Title: [174799] trunk/Source/WebKit2
- Revision
- 174799
- Author
- [email protected]
- Date
- 2014-10-16 16:39:09 -0700 (Thu, 16 Oct 2014)
Log Message
Crash under RemoteLayerTreeHost::getLayer() when closing a tab
https://bugs.webkit.org/show_bug.cgi?id=137796
rdar://problem/18547565
Reviewed by Tim Horton.
CA can call our animation delegate after the RemoteLayerTreeHost has been
destroyed. CAAnimation retains its delegate, so it's safe for us to null out
the WKAnimationDelegate's pointer to the RemoteLayerTreeHost when tearing down
the RemoteLayerTreeHost.
* UIProcess/mac/RemoteLayerTreeHost.mm:
(WebKit::RemoteLayerTreeHost::~RemoteLayerTreeHost):
(WebKit::RemoteLayerTreeHost::animationDidEnd):
* WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm:
(-[WKAnimationDelegate invalidate]):
(-[WKAnimationDelegate animationDidStart:]):
(-[WKAnimationDelegate animationDidStop:finished:]):
Modified Paths
Diff
Modified: trunk/Source/WebKit2/ChangeLog (174798 => 174799)
--- trunk/Source/WebKit2/ChangeLog 2014-10-16 22:43:18 UTC (rev 174798)
+++ trunk/Source/WebKit2/ChangeLog 2014-10-16 23:39:09 UTC (rev 174799)
@@ -1,3 +1,24 @@
+2014-10-16 Simon Fraser <[email protected]>
+
+ Crash under RemoteLayerTreeHost::getLayer() when closing a tab
+ https://bugs.webkit.org/show_bug.cgi?id=137796
+ rdar://problem/18547565
+
+ Reviewed by Tim Horton.
+
+ CA can call our animation delegate after the RemoteLayerTreeHost has been
+ destroyed. CAAnimation retains its delegate, so it's safe for us to null out
+ the WKAnimationDelegate's pointer to the RemoteLayerTreeHost when tearing down
+ the RemoteLayerTreeHost.
+
+ * UIProcess/mac/RemoteLayerTreeHost.mm:
+ (WebKit::RemoteLayerTreeHost::~RemoteLayerTreeHost):
+ (WebKit::RemoteLayerTreeHost::animationDidEnd):
+ * WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm:
+ (-[WKAnimationDelegate invalidate]):
+ (-[WKAnimationDelegate animationDidStart:]):
+ (-[WKAnimationDelegate animationDidStop:finished:]):
+
2014-10-16 Tim Horton <[email protected]>
Implement selection services menu for Legacy WebKit
Modified: trunk/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm (174798 => 174799)
--- trunk/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm 2014-10-16 22:43:18 UTC (rev 174798)
+++ trunk/Source/WebKit2/UIProcess/mac/RemoteLayerTreeHost.mm 2014-10-16 23:39:09 UTC (rev 174799)
@@ -54,6 +54,9 @@
RemoteLayerTreeHost::~RemoteLayerTreeHost()
{
+ for (auto& delegate : m_animationDelegates.values())
+ [delegate.get() invalidate];
+
clearLayers();
}
@@ -168,7 +171,6 @@
if (!animationKey.isEmpty())
m_drawingArea.acceleratedAnimationDidEnd(layerID, animationKey);
-
}
void RemoteLayerTreeHost::clearLayers()
Modified: trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm (174798 => 174799)
--- trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm 2014-10-16 22:43:18 UTC (rev 174798)
+++ trunk/Source/WebKit2/WebProcess/WebPage/mac/PlatformCAAnimationRemote.mm 2014-10-16 23:39:09 UTC (rev 174799)
@@ -54,6 +54,7 @@
}
- (instancetype)initWithLayerID:(GraphicsLayer::PlatformLayerID)layerID layerTreeHost:(WebKit::RemoteLayerTreeHost*)layerTreeHost;
+- (void)invalidate;
@end
@implementation WKAnimationDelegate
@@ -67,8 +68,16 @@
return self;
}
+- (void)invalidate
+{
+ _layerTreeHost = nullptr;
+}
+
- (void)animationDidStart:(CAAnimation *)animation
{
+ if (!_layerTreeHost)
+ return;
+
bool hasExplicitBeginTime = [[animation valueForKey:WKExplicitBeginTimeFlag] boolValue];
CFTimeInterval startTime;
@@ -84,6 +93,9 @@
- (void)animationDidStop:(CAAnimation *)animation finished:(BOOL)finished
{
+ if (!_layerTreeHost)
+ return;
+
_layerTreeHost->animationDidEnd(_layerID, animation);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
