[Webkit-unassigned] [Bug 12170] New: RenderView holds dangling reference to RenderObjects as selection markers

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=12170

           Summary: RenderView holds dangling reference to RenderObjects as
                    selection markers
           Product: WebKit
           Version: 420+ (nightly)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Major
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: occupant4 at gmail.com


I'll follow up with a reproduce case.  Basically, the m_selectionStart and End
members of RenderView are being kept past the lifetime of the RenderObjects
they refer to.  I've only seen it happen as a document is being destroyed. 
This can cause crashes on Windows, but is still a problem on all platforms.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.