[Webkit-unassigned] [Bug 13250] REGRESSION: Browser crash on clicking back button while at link specified above (inspector: ObjC wrapper outlives JS wrapper)

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=13250





------- Comment #21 from mitz at webkit.org  2007-07-22 14:18 PDT -------
<http://trac.webkit.org/projects/webkit/changeset/24493> has made the crash a
little harder to reproduce with the demo app (by coalescing two garbage
collections).

To reproduce the bug with r24493 or later, build the demo app an run it linked
to TOT
WebKit. Do the following:

1) Press Return to load the "a" document.
2) Click the Store button to make and retain an Obj-C wrapper for the document.
3) Choose the "about:blank" document from the combo box, to load that into the
view. This destroys the JS wrapper for the document.
4) Enter "data:text/html,b" in the combo box and press Return to load a "b"
document.
5) Click the Back button to go back to about:blank.
6) Click the Back button to go back to the "a" document.
7) Click the Use button to pass the document to JavaScript and try to use it.
This will trigger the crash.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.