[Webkit-unassigned] [Bug 9929] REGRESSION: crash on logging in on mijnpostbank.nl

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Mar 7 14:48:49 PST 2007


------- Comment #41 from mitz at webkit.org  2007-03-07 14:48 PDT -------
Created an attachment (id=13531)
 --> (http://bugs.webkit.org/attachment.cgi?id=13531&action=view)
Further reduction (will crash)

This crashes often (if it does not, reload).

The crash results from the FrameView being destroyed as a result of removing
the iframe, while a DocLoader still exists whose m_frame pointer points to it.
Might be yet another one of those "executing an arbitrary event handler can get
this deleted, so this should be protected before and/or checked after the event
handler" cases.

Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

More information about the webkit-unassigned mailing list