[webkit-reviews] review granted: [Bug 134117] Unreproducible crashes under WebCore::ScrollingTree::updateTreeFromStateNode() from messaging a deleted Obj-C object : [Attachment 233447] Patch

[bugzilla-daemon at webkit.org]

Simon Fraser (smfr) <simon.fraser at apple.com> has granted Beth Dakin
<bdakin at apple.com>'s request for review:
Bug 134117: Unreproducible crashes under
WebCore::ScrollingTree::updateTreeFromStateNode() from messaging a deleted
Obj-C object
https://bugs.webkit.org/show_bug.cgi?id=134117

Attachment 233447: Patch
https://bugs.webkit.org/attachment.cgi?id=233447&action=review

------- Additional Comments from Simon Fraser (smfr) <simon.fraser at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=233447&action=review


> Source/WebCore/page/scrolling/ScrollingStateNode.h:88
> +    LayerRepresentation(const LayerRepresentation& other)
> +	   : m_platformLayer(other.m_platformLayer)
> +	   , m_layerID(other.m_layerID)
> +	   , m_representation(other.m_representation)

This fails to assign m_graphicsLayer.

> Source/WebCore/page/scrolling/ScrollingStateNode.h:133
> +    LayerRepresentation& operator=(const LayerRepresentation& other)
> +    {
> +	   m_platformLayer = other.m_platformLayer;
> +	   m_layerID = other.m_layerID;
> +	   m_representation = other.m_representation;
> +
> +	   if (m_representation == PlatformLayerRepresentation)
> +	       retainPlatformLayer(m_platformLayer);
> +
> +	   return *this;
> +    }

This fails to copy m_graphicsLayer.