commit 7d836d7464899247283a8acf90d0de322d7befe7
author magomez@igalia.com <magomez@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jun 22 21:41:28 2022 +0000
committer magomez@igalia.com <magomez@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jun 22 21:41:28 2022 +0000
tree 05511973897f2ef4cac66ef0d5291c22097befc3
parent 4d94f87ddfe7bcdf9ec9cc587c4cb105eda6ecf6

[GTK] Crash in WebCore::TextureMapperLayer::paintSelf
https://bugs.webkit.org/show_bug.cgi?id=240283

Reviewed by Carlos Garcia Campos.

There are 4 cases that can happen after there has been a layerFlush and
we're adopting the new state in the composition stage:

1. The layer is removed from the tree and the proxy is not assigned to
   any other layer: the deletion of the layer causes an invalidation of
   the proxy and both are destroyed afterwards. This works fine.

2. The layer is removed from the tree and the proxy is reassigned to a
   new layer: the deletion of the first layer causes the invalidation of
   the proxy, which is then activated on the second layer. As the first
   layer is destroyed, we don't have to worry about dangling references
   from it to the proxy's currentBuffer. This works fine.

3. The layer is kept in the tree and the proxy gets disassociated from
   it and not used by any other layer: we detect that the proxy is not
   used anymore and call invalidate on it, but the layer keeps a
   reference to the proxy's currentBuffer, which has been deleted during
   invalidate, which leads to a crash when trying to render the layer.

4. The layer is kept in the tree and the proxy gets associated to a new
   layer: as we detect that the proxy is still being used it's not
   invalidated, but it gets activated on the second layer. The first
   layer keeps a reference to the proxy's currentBuffer, which will be
   destroyed a bit later when swapBuffers is called on the proxy. This
   leads to a crash when trying to render the first layer.

This patch addresses cases 3. and 4. described above.

* Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayerProxyGL.cpp:
(WebCore::TextureMapperPlatformLayerProxyGL::activateOnCompositingThread):
Ensure that the layer no longer keeps a reference to the current buffer if the
proxy is already active on a different layer.
(WebCore::TextureMapperPlatformLayerProxyGL::invalidate): Ensure that
the invalidated layer does not keep a reference to the current buffer.

Canonical link: https://commits.webkit.org/251754@main


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@295749 268f45cc-cd09-0410-ab3c-d52691b4dbfc