[Webkit-unassigned] [Bug 13124] New: Crash in XMLHttpRequest object - Javascript executes after window is closed?

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=13124

           Summary: Crash in XMLHttpRequest object - Javascript executes
                    after window is closed?
           Product: WebKit
           Version: 522+ (nightly)
          Platform: All
        OS/Version: Mac OS X 10.4
            Status: UNCONFIRMED
          Severity: Critical
          Priority: P1
         Component: WebCore JavaScript
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: tom at bungeelabs.com


Within my webapp, a certain interaction *always* causes a crash. It appears as
though javascript code continues to execute in the context of a GC'd window. As
of yet, I have not been able to create a reduction or successfully break before
the crash in drosera.

The interaction involves 3 windows (1 outer window, 1 outer iframe, and 1
nested iframe):
1) The nested iframe initiates an AJAX request in the context of the outer
window.
2) When the AJAX request completes, the outer window replaces the outer iframe
with another iframe.
3) One of the iframe elements attempts to initiate another AJAX request in the
context of the outer window.
4) The iframe has been cleaned up, and crashes attempting to call
"Window::retrieveActive(exec)->frame()->document()" because there is no
associated frame.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.