[Webkit-unassigned] [Bug 18585] New: Frame::ownerRenderer() is likely causing strange crashes

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=18585

           Summary: Frame::ownerRenderer() is likely causing strange crashes
           Product: WebKit
           Version: 526+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: Frames
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: eric at webkit.org


I was cleaning up Frame yesterday and added a few more ASSERTS.  One in
ownerRenderer:

RenderPart* Frame::ownerRenderer() const
{
    HTMLFrameOwnerElement* ownerElement = d->m_ownerElement;
    if (!ownerElement)
        return 0;
    RenderObject* object = ownerElement->renderer();
    if (!object)
        return 0;
    ASSERT(object->isRenderPart());
    return static_cast<RenderPart*>(object);
}

This ASSERT fails with FOUR layout tests.  Yes, I was surprised too.  I expect
that this could be causing all sorts of wacky crashes in real Safari.

I'm not sure why it's hitting these ASSERTs yet.  I'm also not sure if simply
returning 0 is the right thing.  Why would a frame still think an element was
owning it which wasn't?


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.