[Webkit-unassigned] [Bug 13250] browser crash on cliking back button while at link specified above

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=13250





------- Comment #4 from mitz at webkit.org  2007-04-01 12:22 PDT -------
The Document's JS wrapper gets unprotected when the bindings root is
invalidated when the Frame is cleared. However, the ObjC wrapper sticks around
and therefore also the entry in the ObjC wrapper cache mapping the Document to
it. Thus the inspector is able to retrieve the ObjC wrapper which now points to
a destroyed JS wrapper.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.