[Webkit-unassigned] [Bug 43516] REGRESSION: Huge number of memory leaks after enabling MathML

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=43516





--- Comment #7 from Beth Dakin <bdakin at apple.com>  2010-08-05 11:31:06 PST ---
(In reply to comment #3)
> I believe this is the fix that is needed:
> 
> 
> Index: RenderMathMLOperator.cpp
> ===================================================================
> --- RenderMathMLOperator.cpp    (revision 64442)
> +++ RenderMathMLOperator.cpp    (working copy)
> @@ -121,6 +121,7 @@
>      while (firstChild()) {
>         RenderObject* obj = firstChild();
>         removeChild(obj);
> +       obj->destroy();
>      }
> 
> 
> I just don't have a test system to try this out right now.

Okay, I see why this solution crashes now. When you destroy a renderer, it sets its node's renderer to 0. But in MathML operator, the parent operator and all of the children share the same node! So when we try to destroy the children, we end up setting the parent's node's renderer to 0 as well. 

Since I haven't been involved in MathML lo these many months that you all have been working on it, I would love to be filled in on this design. Why does the MathMLOperator share a node with all of its children? Why aren't the children anonymous content instead?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.