[Webkit-unassigned] [Bug 45737] [Chromium] fast/frames/frame-limit.html is crashing on debug bots after r67179:r67353 roll

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=45737


Dimitri Glazkov (Google) <dglazkov at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #67789|review?, commit-queue?      |review+, commit-queue+
               Flag|                            |




--- Comment #3 from Dimitri Glazkov (Google) <dglazkov at chromium.org>  2010-09-16 09:31:03 PST ---
(From update of attachment 67789)
View in context: https://bugs.webkit.org/attachment.cgi?id=67789&action=prettypatch

> WebCore/html/HTMLFrameOwnerElement.cpp:57
> +        RefPtr<Frame> protect(frame);

Aw crap, frameDetached calls FrameLoader::detachFromParent(), which in turn may destroy the frame. Good catch. 

I see that this is necessary, I just don't like that we have to double-protect it (once here and once in detachFromParent). I also don't like that we end up calling disconnectedOwnerElement twice in such cases.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.