[Webkit-unassigned] [Bug 240283] [GTK] Crash in WebCore::TextureMapperLayer::paintSelf

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=240283

--- Comment #4 from Miguel Gomez <magomez at igalia.com> ---
(In reply to Adrian Perez from comment #3)
> Quick observation: the only change in “main” on top of what's in
> TextureMapperLayer.cpp from the 2.36 release branch is r290575 and
> that one definitely is not a fix for this issue.

There's https://github.com/WebKit/WebKit/commit/fb8ed3d7e9868de82621015783d1f0cc1080b4e4 as well, that was added for 2.36.1, that can be related, despite I'm not sure how  the crash situation can be achieved.

According to the bt, the TextureMapperPlatformLayerBuffer associated to the TextureMapperLayer has been destroyed before calling paintToTextureMapper on it. But for the TextureMapperPlatformLayerBuffer to be destroyed, the TextureMapperPlatformLayerProxy should have been invalidated, which should have removed removed the reference to the TextureMapperPlatformLayerBuffer in the TextureMapperLayer, so in theory this could not happen. But it's happening, so there's some situation where the proxy may not be properly invalidated.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220523/e227dfd8/attachment-0001.htm>