[webkit-changes] [WebKit/WebKit] 355ad2: [UI-side compositing] Crash in displaylink::addObs...

[Simon Fraser]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 355ad2b87eea27d6ec982e9806101addb30ad652
      https://github.com/WebKit/WebKit/commit/355ad2b87eea27d6ec982e9806101addb30ad652
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2023-03-08 (Wed, 08 Mar 2023)

  Changed paths:
    M Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.cpp

  Log Message:
  -----------
  [UI-side compositing] Crash in displaylink::addObserver()
https://bugs.webkit.org/show_bug.cgi?id=253543
rdar://59960084

Reviewed by Tim Horton.

When destroying a RemoteLayerTreeEventDispatcher, we destroy the MomentumEventDispatcher which calls back
into the RemoteLayerTreeEventDispatcher to stop the display link, but this ends in a "start or stop" function,
which tries to start one if the scrolling tree has an animated scroll.

Prevent this by clearing the MomentumEventDispatcher in `invalidate()`, before we explicitly stop the display
link. Add some assertions to verify that we've cleared the MomentumEventDispatcher in the destructor, and that
we don't call startDisplayLinkObserver() after nulling out the client.

* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.cpp:
(WebKit::RemoteLayerTreeEventDispatcher::~RemoteLayerTreeEventDispatcher):
(WebKit::RemoteLayerTreeEventDispatcher::invalidate):
(WebKit::RemoteLayerTreeEventDispatcher::startOrStopDisplayLinkOnMainThread):
(WebKit::RemoteLayerTreeEventDispatcher::startDisplayLinkObserver):
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h:

Canonical link: https://commits.webkit.org/261404@main