[Webkit-unassigned] [Bug 20403] [Gtk] Segfault after a table with an iframe is attempted to be added twice to DOM model with javascript.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=20403





------- Comment #11 from lkcl at lkcl.net  2008-09-03 02:51 PDT -------
i think i know what's going on, here.

i believe that the issue could be related to a Document (the one in the frame)
having been forcibly deleted.  i noticed that the JS bindings have a concept of
"mark()ing".

when a frame is removed from the window, it contains a Document which gets
forcibly deleted.  of course, that doesn't result in any of the bindings
getting deleted.

i am _guessing_ that this is why the concept of "mark()" was added to JS
bindings.

the alternative is to have a "delete" callback into the binding.  when an
object has to be forcibly deleted, you must notify each of the bindings that
the object is now "gone".  it is up to the bindings to then do a "delete" of
whatever kind it needs.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.