[Webkit-unassigned] [Bug 11729] REGRESSION: Crash closing page with frames after selection

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=11729


mitz at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mitz at webkit.org,
                   |                            |ggaren at apple.com




------- Comment #3 from mitz at webkit.org  2006-12-01 00:47 PDT -------
The crash happens because the subframe points to a Page that's already been
destroyed. The Page destructor traverses the frame tree and calls
pageDestroyed() on every subframe, but that's too late since -[_webView close]
tears down the tree before deleting the Page, so the Page destructor actually
doesn't reach any subframes.

It seems to me that Frame::pageDestroyed() could be Frame::detachedFromTree()
and be called when the tree is torn down.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.