[webkit-reviews] review requested: [Bug 12661] REGRESSION: Crash in WebCore::RenderObject::setStyle visiting Bookmarks view while a page is loading : [Attachment 13053] A possible fix, w/o change log and layout test

[bugzilla-request-daemon at macosforge.org]

mitz at webkit.org has asked  for review:
Bug 12661: REGRESSION: Crash in WebCore::RenderObject::setStyle visiting
Bookmarks view while a page is loading
http://bugs.webkit.org/show_bug.cgi?id=12661

Attachment 13053: A possible fix, w/o change log and layout test
http://bugs.webkit.org/attachment.cgi?id=13053&action=edit

------- Additional Comments from mitz at webkit.org
I can reproduce the bug not only with the bookmarks view but also with other
document types that don't use the HTML view, for example, with a PDF. The
problem seems to be that FrameLoader::clear() is never called when such
documents are committed to the frame, and as a result the previous document
remains "live" despite no longer being in the frame.

I am pretty sure that clear() needs to be called when the new document is
committed, but I am less sure that commitProvisionalLoad() is the right place
(or the only additional place) it needs to be called from. I am marking this
for review just to get the opinion of someone with more knowledge of the
loader.