[Webkit-unassigned] [Bug 8360] Repro crash when onscroll handler deletes the scrolled object

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=8360


darin at apple.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |darin at apple.com




------- Comment #4 from darin at apple.com  2006-06-04 12:02 PDT -------
I think the way to fix this is to go from the RenderLayer to the RenderObject
and then from the RenderObject to that RenderObject's Element from the DOM. We
can hold a referenced pointer to that element. Then we can get back to the
layer from the element after the fact. If we can't get back, then we know the
layer was destroyed.

The only problem with that would be if there can be a layer for an object which
does not correspond to an element (generated content). If there can, then this
approach won't work. Otherwise, it's very easy to code. I'm tempted to code it
up and then ask Hyatt if it's OK or not.


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.