DescriptionFix crash in updateCompositorResources due to null root layer. This is an m14-only issue due to side-effects from http://trac.webkit.org/changeset/93940. (Argh, branch-only changes.)
I could not repro this, but I have seen this class of bug in the past where painting causes the root layer to become null, which causes other problems. If I insert a setRootLayer(0) call after painting, it reproduces perfectly.
The issue is that the root layer gets cleared, but it's stored in a layer list and then gets used. The layer list looks like it's used-after-free (oops) because it's passed as a raw reference, but it stores a pointer to a root layer whose cc layer pointer has been cleared and then gets used blindly (extra oops).
So, the solution is to check for this case to avoid the null pointer deref and then to clear the layer list in a better place.
I verified that with setRootLayer(0) that this doesn't blow up. I also verified that memory is properly freed and that the original bug is still fixed.
Patch Set 1 #Patch Set 2 : '' #Patch Set 3 : '' #Messages
Total messages: 3 (0 generated)
|