[Webkit-unassigned] [Bug 18135] Crash in Frame::tree appending iframe

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=18135


ian.eng.webkit at gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|webkit-                     |ian.eng.webkit at gmail.com
                   |unassigned at lists.webkit.org |
             Status|NEW                         |ASSIGNED
  Attachment #20320|                            |review?
               Flag|                            |




------- Comment #8 from ian.eng.webkit at gmail.com  2008-04-03 17:00 PDT -------
Created an attachment (id=20320)
 --> (http://bugs.webkit.org/attachment.cgi?id=20320&action=view)
a patch and a layout test

My attempt to fix the crash. Frame::init() should be called after the subframe
is appended to the frame tree.

I am still not good at right layout test, feel free to make changes.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are the assignee for the bug, or are watching the assignee.