[Webkit-unassigned] [Bug 61159] New: Crashes in RenderLayerBacking::paintingGoesToWindow

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=61159

           Summary: Crashes in RenderLayerBacking::paintingGoesToWindow
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jamesr at chromium.org
                CC: simon.fraser at apple.com, cmarrin at apple.com,
                    vangelis at chromium.org, enne at google.com


We're seeing a number of crashes in RenderLayerBacking::paintingGoesToWindow(), mostly on maps.google.com but also on some other pages.  The top of the callstack looks like:

Source/WebCore/rendering/RenderLayer.h:164]    WebCore::RenderLayerBacking::paintingGoesToWindow
Source/WebCore/rendering/RenderLayer.cpp:3907]    WebCore::RenderLayer::setBackingNeedsRepaintInRect
Source/WebCore/rendering/RenderObject.cpp:1168]    WebCore::RenderObject::repaintUsingContainer
Source/WebCore/rendering/RenderObject.cpp:1238]    WebCore::RenderObject::repaintAfterLayoutIfNeeded
Source/WebCore/rendering/RenderObject.h:812]    WebCore::RenderBlock::layoutBlock
Source/WebCore/rendering/RenderBlock.cpp:1135]    WebCore::RenderBlock::layout

(from http://code.google.com/p/chromium-os/issues/detail?id=15377).  We have had no success trying to reproduce locally and suspect it has something to do with the loading order or something else difficult to reproduce.

The crash is a null pointer deref on the repaintContainer's m_backing.  So it seems that when we enter RenderObject::repaintUsingContainer our RenderView has a non-null m_compositor and that the compositor's m_compositing flag is true, but the layer doesn't have a backing yet.  I suspect that we've entered compositing mode but somehow haven't yet update the layers, but am not sure.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.