[Threaded Compositor] Crash when detaching the CoordinatedGraphicsScene

https://bugs.webkit.org/show_bug.cgi?id=167547

Reviewed by Michael Catanzaro.

It seems that commitSceneState() can be called after the CoordinatedGraphicsScene has been detached.

* Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
(WebKit::CoordinatedGraphicsScene::commitSceneState): Return early if scene has been detached.
(WebKit::CoordinatedGraphicsScene::detach): Take the render queue lock before clearing the render queue.

Canonical link: https://commits.webkit.org/184592@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@211348 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit2/ChangeLog

@@ -1,3 +1,16 @@
+2017-01-28  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [Threaded Compositor] Crash when detaching the CoordinatedGraphicsScene
+        https://bugs.webkit.org/show_bug.cgi?id=167547
+
+        Reviewed by Michael Catanzaro.
+
+        It seems that commitSceneState() can be called after the CoordinatedGraphicsScene has been detached.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
+        (WebKit::CoordinatedGraphicsScene::commitSceneState): Return early if scene has been detached.
+        (WebKit::CoordinatedGraphicsScene::detach): Take the render queue lock before clearing the render queue.
+
 2017-01-28  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         [Threaded Compositor] Crash when deleting the compositor run loop

Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp

@@ -598,6 +598,9 @@ void CoordinatedGraphicsScene::commitPendingBackingStoreOperations()
 
 void CoordinatedGraphicsScene::commitSceneState(const CoordinatedGraphicsState& state)
 {
+    if (!m_client)
+        return;
+
     m_renderedContentsScrollPosition = state.scrollPosition;
 
     createLayers(state.layersToCreate);
@@ -707,9 +710,10 @@ void CoordinatedGraphicsScene::setLayerAnimationsIfNeeded(TextureMapperLayer* la
 void CoordinatedGraphicsScene::detach()
 {
     ASSERT(isMainThread());
-    m_renderQueue.clear();
     m_isActive = false;
     m_client = nullptr;
+    LockHolder locker(m_renderQueueMutex);
+    m_renderQueue.clear();
 }
 
 void CoordinatedGraphicsScene::appendUpdate(std::function<void()>&& function)