<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Follow-up (r213833): write a layout test for 169199"
href="https://bugs.webkit.org/show_bug.cgi?id=169576#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Follow-up (r213833): write a layout test for 169199"
href="https://bugs.webkit.org/show_bug.cgi?id=169576">bug 169576</a>
from <span class="vcard"><a class="email" href="mailto:magomez@igalia.com" title="Miguel Gomez <magomez@igalia.com>"> <span class="fn">Miguel Gomez</span></a>
</span></b>
<pre>I'm working on this.
I have the test that deletes the decoder and works fine. But without r213833 it doesn't necessarily cause a crash, as it's a race condition.
With the implementation of BitmapImage::clearDecoder() you suggest, ImageSource::clear() calls setData() just after setting the ImageFrameCache decoder to nullptr, and that setData() creates a new decoder that the decoding thread will use without crashing.
The crash happens only when the decoding thread is using the decoder exactly between its destruction and the creation of the new one, which is pretty hard to reproduce. I could force it though, using an implementation of BitmapImage::clearDecoder() that just deletes the decoder and doesn't cause setData() to be called.
Should I do that? Or should I use the implementation you suggest, even if the crash is not easily reproducible without r213833?</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>