Attachment 360327 Details for Bug 193897 – patch

[patch] patch

applyProperties-crash-2.patch (text/plain), 3.06 KB, created by Antti Koivisto on 2019-01-28 01:43:09 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Antti Koivisto

Created: 2019-01-28 01:43:09 PST

Size: 3.06 KB

patch

obsolete

>Index: Source/WebKit/ChangeLog
>===================================================================
>--- Source/WebKit/ChangeLog	(revision 240558)
>+++ Source/WebKit/ChangeLog	(working copy)
>@@ -1,3 +1,19 @@
>+2019-01-28  Antti Koivisto  <antti@apple.com>
>+
>+        Crash in WebKit::RemoteLayerTreePropertyApplier::updateChildren
>+        https://bugs.webkit.org/show_bug.cgi?id=193897
>+        <rdar://problem/47427750>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        There has been some null pointer crashes where we fail to find a remote layer tree node that matches
>+        the transaction properties.
>+
>+        * Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:
>+        (WebKit::RemoteLayerTreePropertyApplier::updateChildren):
>+
>+        Null check the nodes.
>+
> 2018-12-15  Darin Adler  <darin@apple.com>
> 
>         Replace many uses of String::format with more type-safe alternatives
>Index: Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm
>===================================================================
>--- Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm	(revision 240407)
>+++ Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm	(working copy)
>@@ -277,7 +277,11 @@ void RemoteLayerTreePropertyApplier::upd
>     auto hasViewChildren = [&] {
>         if (node.uiView() && [[node.uiView() subviews] count])
>             return true;
>-        return !properties.children.isEmpty() && relatedLayers.get(properties.children.first())->uiView();
>+        if (properties.children.isEmpty())
>+            return false;
>+        auto* childNode = relatedLayers.get(properties.children.first());
>+        ASSERT(childNode);
>+        return childNode && childNode->uiView();
>     };
> 
>     auto contentView = [&] {
>@@ -295,6 +299,9 @@ void RemoteLayerTreePropertyApplier::upd
>         RetainPtr<NSMutableArray> subviews = adoptNS([[NSMutableArray alloc] initWithCapacity:properties.children.size()]);
>         for (auto& child : properties.children) {
>             auto* childNode = relatedLayers.get(child);
>+            ASSERT(childNode);
>+            if (!childNode)
>+                continue;
>             ASSERT(childNode->uiView());
>             [subviews addObject:childNode->uiView()];
>         }
>@@ -307,6 +314,9 @@ void RemoteLayerTreePropertyApplier::upd
>     RetainPtr<NSMutableArray> sublayers = adoptNS([[NSMutableArray alloc] initWithCapacity:properties.children.size()]);
>     for (auto& child : properties.children) {
>         auto* childNode = relatedLayers.get(child);
>+        ASSERT(childNode);
>+        if (!childNode)
>+            continue;
> #if PLATFORM(IOS_FAMILY)
>         ASSERT(!childNode->uiView());
> #endif
>@@ -339,7 +349,11 @@ void RemoteLayerTreePropertyApplier::upd
>         return;
>     }
> 
>-    CALayer *maskLayer = relatedLayers.get(properties.maskLayerID)->layer();
>+    auto* maskNode = relatedLayers.get(properties.maskLayerID);
>+    ASSERT(maskNode);
>+    if (!maskNode)
>+        return;
>+    CALayer *maskLayer = maskNode->layer();
>     ASSERT(!maskLayer.superlayer);
>     if (maskLayer.superlayer)
>         return;

Actions: View | Formatted Diff | Diff

Attachments on bug 193897: 360326 | 360327