[Webkit-unassigned] [Bug 111074] REGRESSION(r141450): failed ASSERT in FrameView::scheduleRelayout()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=111074





--- Comment #19 from Mikhail Pozdnyakov <mikhail.pozdnyakov at intel.com>  2013-03-22 07:49:04 PST ---
(In reply to comment #17)
> (From update of attachment 192962 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=192962&action=review
> 
> > Source/WebCore/ChangeLog:11
> > +        Update RenderView so it retrieves the FrameView from the Document instead
> > +        of storing it as a member upon construction. This makes sure that the
> > +        FrameView returned by the RenderView always matches the one of the
> > +        Document.
> 
> But this implies that the RenderView can retrieve a different FrameView at different times, which is totally unexpected. I think this change is just papering over the cracks. We need to understand why the wrong FrameView is retrieved when the assertion happens.

The wrong frame view is retrieved because FrameView is created several times for the same frame. The frame however always has the same document instance which has the same renderer (RenderView) and RenderView has the same pointer to FrameView (which is out-dated).

There are several ways to fix it, and I am not sure which is the best now. Do we really need different FrameView instances for the same frame? Cannot we re-use the existing one instead of re-creating it? And if we do need to re-create FrameView, we probably need to re-create some other objects (document renderer at least because it contains invalid data otherwise).

(I was uploading the exactly same patch to bug#112921, but noticed that the current bug is already addressing the issue :) ).

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.