[Webkit-unassigned] [Bug 14503] REGRESSION: Navigating away from certain pages with dynamically created iframes triggers an ASSERT in Widget::~Widget

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=14503





------- Comment #12 from ggaren at apple.com  2007-09-13 19:30 PDT -------
The sequence of events is this:
1. <iframe> element creates FrameView A
2. JavaScripts sets <iframe> element's id and src attributes
3. <iframe> element responds to src attribute change by trying to load a URL
into FrameView A
4. <iframe> element can't find FrameView A because its id has changed, so it
creates FrameView B
...
5. FrameView A later ASSERTs in its destructor because it hasn't been removed
from its parent

My guess is that resolving the frame doubling problem will cause tear-down to
proceed normally, fixing the ASSERT.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.