[Webkit-unassigned] [Bug 10093] REGRESSION(15585): Crash under MallocDebug and gmalloc related to ListMarkerBox

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=10093


opendarwin.org at mitzpettel.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |opendarwin.org at mitzpettel.co
                   |                            |m




------- Comment #9 from opendarwin.org at mitzpettel.com  2006-08-02 04:31 PDT -------
r15585 added code that accesses the parent in ListMarkerBox::destroy(), and in
the case of this bug (or any relayout of a list item) the parent is freed
before that code is reached. None of the other InlineBox destroy() methods
access the parent, and the change log from r15585 doesn't explain exactly why
you need to do it only for list markers.


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.