[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[simon.fraser at apple.com]

The following commit has been merged in the debian/experimental branch:
commit a43e92a8153964a4e4a8554a4acee4188553b6ce
Author: simon.fraser at apple.com <simon.fraser at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Aug 3 18:12:38 2010 +0000

    2010-08-03  Simon Fraser  <simon.fraser at apple.com>
    
            Reviewed by Sam Weinig.
    
            Compositing iframe layout test crashes in WebKit2
            https://bugs.webkit.org/show_bug.cgi?id=42860
    
            Part one of the fix: make DrawingArea ref-counted, so that the object
            can survide a swap in drawing areas inside the run loop observer callback.
    
            * WebProcess/WebPage/DrawingArea.cpp:
            (WebKit::DrawingArea::create):
            * WebProcess/WebPage/DrawingArea.h:
            * WebProcess/WebPage/WebPage.h:
            * WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm:
            (WebKit::LayerBackedDrawingArea::platformClear):
            (WebKit::LayerBackedDrawingArea::updateLayoutRunLoopObserverCallback):
            (WebKit::LayerBackedDrawingArea::updateLayoutRunLoopObserverFired):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@64569 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebKit2/ChangeLog b/WebKit2/ChangeLog
index 2f3da91..1f9ed5a 100644
--- a/WebKit2/ChangeLog
+++ b/WebKit2/ChangeLog
@@ -1,3 +1,22 @@
+2010-08-03  Simon Fraser  <simon.fraser at apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Compositing iframe layout test crashes in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=42860
+        
+        Part one of the fix: make DrawingArea ref-counted, so that the object
+        can survide a swap in drawing areas inside the run loop observer callback.
+
+        * WebProcess/WebPage/DrawingArea.cpp:
+        (WebKit::DrawingArea::create):
+        * WebProcess/WebPage/DrawingArea.h:
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm:
+        (WebKit::LayerBackedDrawingArea::platformClear):
+        (WebKit::LayerBackedDrawingArea::updateLayoutRunLoopObserverCallback):
+        (WebKit::LayerBackedDrawingArea::updateLayoutRunLoopObserverFired):
+
 2010-08-03  Anders Carlsson  <andersca at apple.com>
 
         Reviewed by Adam Roben.
diff --git a/WebKit2/WebProcess/WebPage/DrawingArea.cpp b/WebKit2/WebProcess/WebPage/DrawingArea.cpp
index 9be6b4f..0406767 100644
--- a/WebKit2/WebProcess/WebPage/DrawingArea.cpp
+++ b/WebKit2/WebProcess/WebPage/DrawingArea.cpp
@@ -33,24 +33,23 @@
 
 namespace WebKit {
 
-DrawingArea* DrawingArea::create(Type type, WebPage* webPage)
+PassRefPtr<DrawingArea> DrawingArea::create(Type type, WebPage* webPage)
 {
-    DrawingArea* drawingArea = 0;
     switch (type) {
         case None:
             ASSERT_NOT_REACHED();
             break;
+
         case ChunkedUpdateDrawingAreaType:
-            drawingArea = new ChunkedUpdateDrawingArea(webPage);
-            break;
+            return adoptRef(new ChunkedUpdateDrawingArea(webPage));
+
 #if USE(ACCELERATED_COMPOSITING) && PLATFORM(MAC)
         case LayerBackedDrawingAreaType:
-            drawingArea = new LayerBackedDrawingArea(webPage);
-            break;
+            return adoptRef(new LayerBackedDrawingArea(webPage));
 #endif
     }
 
-    return drawingArea;
+    return 0;
 }
 
 DrawingArea::DrawingArea(Type type, WebPage* webPage)
diff --git a/WebKit2/WebProcess/WebPage/DrawingArea.h b/WebKit2/WebProcess/WebPage/DrawingArea.h
index cd46188..a180e14 100644
--- a/WebKit2/WebProcess/WebPage/DrawingArea.h
+++ b/WebKit2/WebProcess/WebPage/DrawingArea.h
@@ -27,6 +27,8 @@
 #define DrawingArea_h
 
 #include <WebCore/IntRect.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
     class IntRect;
@@ -46,7 +48,7 @@ namespace WebKit {
 
 class WebPage;
 
-class DrawingArea {
+class DrawingArea : public RefCounted<DrawingArea> {
 public:
     // This has to match DrawingAreaProxy::Type.
     enum Type {
@@ -58,7 +60,8 @@ public:
     };
 
     // FIXME: It might make sense to move this create function into a factory style class. 
-    static DrawingArea* create(Type, WebPage*);
+    static PassRefPtr<DrawingArea> create(Type, WebPage*);
+
     virtual ~DrawingArea();
     
     Type type() const { return m_type; }
diff --git a/WebKit2/WebProcess/WebPage/WebPage.h b/WebKit2/WebProcess/WebPage/WebPage.h
index a5d9557..35cbc18 100644
--- a/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/WebKit2/WebProcess/WebPage/WebPage.h
@@ -152,7 +152,7 @@ private:
     HashMap<uint64_t, WebFrame*> m_frameMap;
 
     WebCore::IntSize m_viewSize;
-    OwnPtr<DrawingArea> m_drawingArea;
+    RefPtr<DrawingArea> m_drawingArea;
 
     InjectedBundlePageEditorClient m_editorClient;
     InjectedBundlePageLoaderClient m_loaderClient;
diff --git a/WebKit2/WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm b/WebKit2/WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm
index ca99377..0c644f4 100644
--- a/WebKit2/WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm
+++ b/WebKit2/WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm
@@ -60,6 +60,8 @@ void LayerBackedDrawingArea::platformClear()
     WKCARemoteLayerClientInvalidate(m_remoteLayerRef.get());
     m_remoteLayerRef = 0;
 #endif
+
+    m_attached = false;
 }
 
 void LayerBackedDrawingArea::attachCompositingContext()
@@ -143,14 +145,18 @@ void LayerBackedDrawingArea::removeUpdateLayoutRunLoopObserver()
 
 void LayerBackedDrawingArea::updateLayoutRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void* info)
 {
-    LayerBackedDrawingArea* drawingArea = reinterpret_cast<LayerBackedDrawingArea*>(info);
+    // Keep the drawing area alive while running the callback, since that does layout,
+    // which might replace this drawing area with one of another type.
+    RefPtr<LayerBackedDrawingArea> drawingArea = reinterpret_cast<LayerBackedDrawingArea*>(info);
     drawingArea->updateLayoutRunLoopObserverFired();
 }
 
 void LayerBackedDrawingArea::updateLayoutRunLoopObserverFired()
 {
     m_webPage->layoutIfNeeded();
-    syncCompositingLayers();
+    
+    if (m_attached)
+        syncCompositingLayers();
 }
 
 } // namespace WebKit

-- 
WebKit Debian packaging