[Webkit-unassigned] [Bug 13563] REGRESSION: Crash loading message in Yahoo! Mail

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=13563





------- Comment #13 from mitz at webkit.org  2007-05-15 16:22 PDT -------
(In reply to comment #6)
> What appears to be happening is that the loop iterating over CSSRuleData
> objects in CSSStyleSelector::matchRulesForList() is getting a rule that has
> been deleted (or is in the process of being deleted) while it's being accessed
> in that loop.

If the bug is still reproducible, could you do the following? Set a breakpoint
at ~CSSRuleData() and have it print |this| and a backtrace each time it's hit.
When you crash as a result of dereferencing a deleted CSSRuleData, get the
invalid pointer and find the backtrace from when it was deleted. Not sure it
would help much, but IMO it's worth trying.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.