Fix crash in RenderLayerCompositor::updateCompositingLayers

Clear the composited mode for layers before running the loop to mark the
ones following a fixed layer as composited. This fixes the scenario
where a layer switches between fixed and not, but the layers following
it have an inconsistent compositing mode.

Bug: 6417235
Change-Id: Ifa57ec482d4570a7798663fa0c6dc6c60839f5f6

1 files changed, 19 insertions, 16 deletions

diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 6b669e8..f5dddc0 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -302,6 +302,7 @@ void RenderLayerCompositor::updateCompositingLayers(CompositingUpdateType update
         bool layersChanged = false;
 
 #if ENABLE(COMPOSITED_FIXED_ELEMENTS)
+        compState.m_positionedSibling = false;
         compState.m_hasFixedElement = false;
 #endif
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
@@ -657,27 +658,25 @@ bool RenderLayerCompositor::checkForPositionedElements(Vector<RenderLayer*>* lis
     // composited. The layers' surfaces will be merged if needed UI-side.
     for (int j = 0; j < listSize; ++j) {
         RenderLayer* currentLayer = list->at(j);
-        if (currentLayer->shouldComposite())
-            continue;
 
-        if (currentLayer->isFixed() && needsToBeComposited(currentLayer)) {
-            haveFixedLayer = j;
-            fixedSibling = true;
-        }
+        // clear the composited flag first
+        currentLayer->setShouldComposite(false);
 
-        // Bypass fixed layers with a width or height or 1 or less...
-        IntRect currentLayerBounds = currentLayer->renderer()->localToAbsoluteQuad(
-            FloatRect(currentLayer->localBoundingBox())).enclosingBoundingBox();
-        if ((currentLayerBounds.width() <= 1
-            || currentLayerBounds.height() <= 1)
-            && haveFixedLayer == j) {
-            haveFixedLayer = -1;
-            fixedSibling = false;
+        if (currentLayer->isFixed() && needsToBeComposited(currentLayer)) {
+            // Ignore fixed layers with a width or height or 1 or less...
+            IntRect currentLayerBounds = currentLayer->renderer()->localToAbsoluteQuad(
+                FloatRect(currentLayer->localBoundingBox())).enclosingBoundingBox();
+            if (currentLayerBounds.width() > 1 && currentLayerBounds.height() > 1) {
+                haveFixedLayer = j;
+                fixedSibling = true;
+            }
+            continue;
         }
 
-        if (haveFixedLayer != -1 && haveFixedLayer != j)
+        if (haveFixedLayer != -1)
             currentLayer->setShouldComposite(true);
     }
+
     return positionedSibling || fixedSibling;
 }
 
@@ -867,6 +866,8 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 #if ENABLE(COMPOSITED_FIXED_ELEMENTS)
     if (childState.m_hasFixedElement)
         compositingState.m_hasFixedElement = true;
+    if (childState.m_positionedSibling)
+        compositingState.m_positionedSibling = true;
 #endif
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     if (childState.m_hasScrollableElement)
@@ -889,7 +890,9 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     // We also need to check that we don't have a scrollable layer, as this
     // would not have set the m_subtreeIsCompositing flag
-    if (layer->isRootLayer() && !childState.m_subtreeIsCompositing && !childState.m_hasScrollableElement && !childState.m_hasFixedElement && !requiresCompositingLayer(layer) && !m_forceCompositingMode) {
+    if (layer->isRootLayer() && !childState.m_subtreeIsCompositing
+        && !childState.m_hasScrollableElement && !childState.m_positionedSibling && !childState.m_hasFixedElement
+        && !requiresCompositingLayer(layer) && !m_forceCompositingMode) {
 #else
     if (layer->isRootLayer() && !childState.m_subtreeIsCompositing && !requiresCompositingLayer(layer) && !m_forceCompositingMode) {
 #endif