[Webkit-unassigned] [Bug 9929] REGRESSION: crash on logging in on mijnpostbank.nl

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=9929





------- Comment #41 from mitz at webkit.org  2007-03-07 14:48 PDT -------
Created an attachment (id=13531)
 --> (http://bugs.webkit.org/attachment.cgi?id=13531&action=view)
Further reduction (will crash)

This crashes often (if it does not, reload).

The crash results from the FrameView being destroyed as a result of removing
the iframe, while a DocLoader still exists whose m_frame pointer points to it.
Might be yet another one of those "executing an arbitrary event handler can get
this deleted, so this should be protected before and/or checked after the event
handler" cases.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.