[Webkit-unassigned] [Bug 34153] Crash in WebCore while processing the fast scrolling code path.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=34153


Benjamin Poulain <benjamin.poulain at nokia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #47403|                            |review?, commit-queue?
               Flag|                            |




--- Comment #4 from Benjamin Poulain <benjamin.poulain at nokia.com>  2010-01-26 04:49:53 PST ---
Created an attachment (id=47403)
 --> (https://bugs.webkit.org/attachment.cgi?id=47403)
Unregister the RenderObject in corner cases

This patch should fix the problem for the websites listed.

The problem is deriving from the change of
https://bugs.webkit.org/show_bug.cgi?id=33150
RenderWidget::destroy() is special and do not call ::destroy() on the parent.
The code for cleaning the state must be copied in that class (as said in the
comments of RenderWidget::destroy()).

It's great you have those tests.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.