[Webkit-unassigned] [Bug 103410] [Texmap] REGRESSION(r135620) QtTestBrowser crashes on Google-gravity.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=103410





--- Comment #4 from Huang Dongsung <luxtella at company100.net>  2012-11-27 18:00:53 PST ---
After I read code again, I understand GraphicsLayerTextureMapper::updateBackingStore has a problem.

GraphicsLayer::FlushCompositingState can be called by RenderLayerBacking. It means this method can be called before creating TextureMapper.
So TextureMapperLayer::flushCompositingState() checks and if textureMapper does not exist, do nothing.

void TextureMapperLayer::flushCompositingState(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper, int options)
{
    if (!textureMapper)
        return;
    ...
}

But GraphicsLayerTextureMapper::updateBackingStore expects textureMapper always exists.
Bug 103366 can fix this bug, but I think it is right that this bug fixes hitting assertion and then reviews Bug 103366.

If we change code like following code, this bug can be fixed. In the detail, we must keep m_needsDisplay until  GraphicsLayerTextureMapper::prepareBackingStore() is completed, so m_needsDisplay should be removed in GraphicsLayerTextureMapper::didFlushCompositingState().

I'm glad anyone to fix it. If you want, I can do it of course.

@@ -404,8 +410,6 @@ void GraphicsLayerTextureMapper::didFlushCompositingState()
 {
     updateBackingStore();
     m_changeMask = 0;
-    m_needsDisplay = false;
-    m_needsDisplayRect = IntRect();
 }

 void GraphicsLayerTextureMapper::didFlushCompositingStateRecursive()
@@ -430,6 +434,10 @@ void GraphicsLayerTextureMapper::updateBackingStore()

 void GraphicsLayerTextureMapper::prepareBackingStore()
 {
+    TextureMapper* textureMapper = m_layer->textureMapper();
+    if (!textureMapper)
+        return;
+
     if (!shouldHaveBackingStore()) {
         m_backingStore.clear();
         return;
@@ -441,9 +449,6 @@ void GraphicsLayerTextureMapper::prepareBackingStore()
     if (dirtyRect.isEmpty())
         return;

-    TextureMapper* textureMapper = m_layer->textureMapper();
-    ASSERT(textureMapper);
-
     if (!m_backingStore)
         m_backingStore = TextureMapperTiledBackingStore::create();

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.