[Webkit-unassigned] [Bug 36894] New: Crash with frame flattening on after r56854
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Mar 31 11:49:31 PDT 2010
https://bugs.webkit.org/show_bug.cgi?id=36894
Summary: Crash with frame flattening on after r56854
Product: WebKit
Version: 528+ (Nightly build)
Platform: PC
OS/Version: Mac OS X 10.5
Status: NEW
Severity: Normal
Priority: P2
Component: Frames
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: bolsinga at apple.com
CC: kenneth at webkit.org
Thread 0 Crashed: Dispatch queue: com.apple.main-thread
0 com.apple.WebCore 0x00000001011cd4c0
WebCore::Frame::ownerElement() const + 12 (Frame.cpp:1107)
1 com.apple.WebCore 0x00000001011f6d6c
WebCore::FrameView::avoidScrollbarCreation() + 36 (FrameView.cpp:334)
2 com.apple.WebCore 0x00000001018101c4
WebCore::ScrollView::setHasHorizontalScrollbar(bool) + 38 (ScrollView.cpp:84)
3 com.apple.WebCore 0x00000001011f9faf
WebCore::FrameView::~FrameView() + 359 (FrameView.cpp:165)
m_frame is being destroyed here and is being accessed.
To reproduce apply the following patch, build WebKit debug and run Safari:
diff --git a/WebKit/mac/WebView/WebPreferences.mm
b/WebKit/mac/WebView/WebPreferences.mm
index 84a6e9e..28f8f17 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -357,7 +357,7 @@ static WebCacheModel cacheModelForMainBundle(void)
[NSNumber numberWithBool:NO], WebKitWebGLEnabledPreferenceKey,
[NSNumber numberWithBool:NO],
WebKitUsesProxiedOpenPanelPreferenceKey,
[NSNumber numberWithUnsignedInt:4],
WebKitPluginAllowedRunTimePreferenceKey,
- [NSNumber numberWithBool:NO],
WebKitFrameFlatteningEnabledPreferenceKey,
+ [NSNumber numberWithBool:YES],
WebKitFrameFlatteningEnabledPreferenceKey,
nil];
// This value shouldn't ever change, which is assumed in the
initialization of WebKitPDFDisplay
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list