Bug 1394337 - Fix uninitialized mPipelineId by WebRenderBridgeParent::CreateDestroyed() r=kats

WebRenderBridgeParent holds uninitialized mPipelineId when it was created by WebRenderBridgeParent::CreateDestroyed(). Then when CrossProcessCompositorBridgeParent::DeallocPWebRenderBridgeParent is called for the WebRenderBridgeParent, it will call EraseLayerState with some garbage uninitialized value, and so it will erase some random layer state entry.
This commit is contained in:
sotaro 2017-08-29 22:41:53 +09:00
Родитель a29b277953
Коммит 6814d355af
4 изменённых файлов: 8 добавлений и 7 удалений

Просмотреть файл

@ -1697,7 +1697,7 @@ CompositorBridgeParent::AllocPWebRenderBridgeParent(const wr::PipelineId& aPipel
RefPtr<widget::CompositorWidget> widget = mWidget;
RefPtr<wr::WebRenderAPI> api = wr::WebRenderAPI::Create(this, Move(widget), aSize);
if (!api) {
mWrBridge = WebRenderBridgeParent::CreateDestroyed();
mWrBridge = WebRenderBridgeParent::CreateDestroyed(aPipelineId);
mWrBridge.get()->AddRef(); // IPDL reference
*aIdNamespace = mWrBridge->GetIdNamespace();
*aTextureFactoryIdentifier = TextureFactoryIdentifier(LayersBackend::LAYERS_NONE);

Просмотреть файл

@ -217,7 +217,7 @@ CrossProcessCompositorBridgeParent::AllocPWebRenderBridgeParent(const wr::Pipeli
// This could happen when this function is called after CompositorBridgeParent destruction.
// This was observed during Tab move between different windows.
NS_WARNING("Created child without a matching parent?");
parent = WebRenderBridgeParent::CreateDestroyed();
parent = WebRenderBridgeParent::CreateDestroyed(aPipelineId);
parent->AddRef(); // IPDL reference
*aIdNamespace = parent->GetIdNamespace();
*aTextureFactoryIdentifier = TextureFactoryIdentifier(LayersBackend::LAYERS_NONE);

Просмотреть файл

@ -143,8 +143,9 @@ WebRenderBridgeParent::WebRenderBridgeParent(CompositorBridgeParentBase* aCompos
}
}
WebRenderBridgeParent::WebRenderBridgeParent()
WebRenderBridgeParent::WebRenderBridgeParent(const wr::PipelineId& aPipelineId)
: mCompositorBridge(nullptr)
, mPipelineId(aPipelineId)
, mChildLayerObserverEpoch(0)
, mParentLayerObserverEpoch(0)
, mWrEpoch(0)
@ -156,9 +157,9 @@ WebRenderBridgeParent::WebRenderBridgeParent()
}
/* static */ WebRenderBridgeParent*
WebRenderBridgeParent::CreateDestroyed()
WebRenderBridgeParent::CreateDestroyed(const wr::PipelineId& aPipelineId)
{
return new WebRenderBridgeParent();
return new WebRenderBridgeParent(aPipelineId);
}
WebRenderBridgeParent::~WebRenderBridgeParent()

Просмотреть файл

@ -55,7 +55,7 @@ public:
RefPtr<AsyncImagePipelineManager>&& aImageMgr,
RefPtr<CompositorAnimationStorage>&& aAnimStorage);
static WebRenderBridgeParent* CreateDestroyed();
static WebRenderBridgeParent* CreateDestroyed(const wr::PipelineId& aPipelineId);
wr::PipelineId PipelineId() { return mPipelineId; }
wr::WebRenderAPI* GetWebRenderAPI() { return mApi; }
@ -198,7 +198,7 @@ public:
CompositorAnimationStorage* aAnimStorage);
private:
WebRenderBridgeParent();
explicit WebRenderBridgeParent(const wr::PipelineId& aPipelineId);
virtual ~WebRenderBridgeParent();
uint64_t GetLayersId() const;