[Webkit-unassigned] [Bug 144399] REGRESSION: js/dom/navigator-plugins-crash.html asserts a lot

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144399

Alexey Proskuryakov <ap at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |andersca at apple.com,
                   |                            |conrad_shultz at apple.com
           See Also|                            |https://bugs.webkit.org/sho
                   |                            |w_bug.cgi?id=142506

--- Comment #1 from Alexey Proskuryakov <ap at webkit.org> ---
I don't know why this started now, but the code is somewhat new too, as it was added in  <http://trac.webkit.org/changeset/181562>.

I don't think that there is any guarantee of m_index remaining a valid index.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150429/d7be1348/attachment.html>