[webkit-reviews] review requested: [Bug 34153] Crash in WebCore while processing the fast scrolling code path. : [Attachment 47403] Unregister the RenderObject in corner cases

[bugzilla-daemon at webkit.org]

Benjamin Poulain <benjamin.poulain at nokia.com> has asked  for review:
Bug 34153: Crash in WebCore while processing the fast scrolling code path.
https://bugs.webkit.org/show_bug.cgi?id=34153

Attachment 47403: Unregister the RenderObject in corner cases
https://bugs.webkit.org/attachment.cgi?id=47403&action=review

------- Additional Comments from Benjamin Poulain <benjamin.poulain at nokia.com>
This patch should fix the problem for the websites listed.

The problem is deriving from the change of
https://bugs.webkit.org/show_bug.cgi?id=33150
RenderWidget::destroy() is special and do not call ::destroy() on the parent.
The code for cleaning the state must be copied in that class (as said in the
comments of RenderWidget::destroy()).

It's great you have those tests.