[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[andersca at apple.com]

The following commit has been merged in the debian/experimental branch:
commit 74f1b3d65b749ae4e915d74aee79f58a4db0a1be
Author: andersca at apple.com <andersca at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Nov 3 20:34:50 2010 +0000

    Crash when layout in response to setSize changes the drawing area
    https://bugs.webkit.org/show_bug.cgi?id=48947
    
    Reviewed by Simon Fraser.
    
    This is tested by compositing/plugins/small-to-large-composited-plugin.html.
    
    * WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp:
    (WebKit::ChunkedUpdateDrawingArea::setSize):
    * WebProcess/WebPage/LayerBackedDrawingArea.cpp:
    (WebKit::LayerBackedDrawingArea::setSize):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71261 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebKit2/ChangeLog b/WebKit2/ChangeLog
index f8471f1..93d7c8f 100644
--- a/WebKit2/ChangeLog
+++ b/WebKit2/ChangeLog
@@ -1,5 +1,19 @@
 2010-11-03  Anders Carlsson  <andersca at apple.com>
 
+        Reviewed by Simon Fraser.
+
+        Crash when layout in response to setSize changes the drawing area
+        https://bugs.webkit.org/show_bug.cgi?id=48947
+
+        This is tested by compositing/plugins/small-to-large-composited-plugin.html.
+
+        * WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp:
+        (WebKit::ChunkedUpdateDrawingArea::setSize):
+        * WebProcess/WebPage/LayerBackedDrawingArea.cpp:
+        (WebKit::LayerBackedDrawingArea::setSize):
+
+2010-11-03  Anders Carlsson  <andersca at apple.com>
+
         Reviewed by Adam Roben.
 
         Pass the accelerated compositing render server port to the plug-in process at startup
diff --git a/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp b/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp
index 7e4dcdf..d2834bf 100644
--- a/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp
+++ b/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp
@@ -127,11 +127,17 @@ void ChunkedUpdateDrawingArea::setSize(const IntSize& viewSize)
     // We don't want to wait for an update until we display.
     m_isWaitingForUpdate = false;
     
-    m_webPage->setSize(viewSize);
+    // Laying out the page can cause the drawing area to change so we keep an extra reference.
+    RefPtr<ChunkedUpdateDrawingArea> protect(this);
 
-    // Layout if necessary.
+    m_webPage->setSize(viewSize);
     m_webPage->layoutIfNeeded();
 
+    if (m_webPage->drawingArea() != this) {
+        // The drawing area changed, return early.
+        return;
+    }
+
     if (m_paintingIsSuspended) {
         ASSERT(!m_displayTimer.isActive());
 
diff --git a/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.cpp b/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.cpp
index 163af0a..038b7b3 100644
--- a/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.cpp
+++ b/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.cpp
@@ -106,12 +106,18 @@ void LayerBackedDrawingArea::setSize(const IntSize& viewSize)
 
     m_backingLayer->setSize(viewSize);
     scheduleCompositingLayerSync();
+
+    // Laying out the page can cause the drawing area to change so we keep an extra reference.
+    RefPtr<LayerBackedDrawingArea> protect(this);
     
     m_webPage->setSize(viewSize);
-
-    // Layout if necessary.
     m_webPage->layoutIfNeeded();
 
+    if (m_webPage->drawingArea() != this) {
+        // The drawing area changed, return early.
+        return;
+    }
+    
     WebProcess::shared().connection()->send(DrawingAreaProxyMessage::DidSetSize, m_webPage->pageID(), CoreIPC::In());
 }
 

-- 
WebKit Debian packaging