Brady ran into some crashes while doing his history work. At the bottom are problems with the lifetime of the Frame's ownerElement pointer. I have a patch to address this.
Created attachment 11792 [details] patch, no change log yet
Created attachment 11810 [details] patch with change log
Comment on attachment 11810 [details] patch with change log Fix the ChangeLog merging madness, and r=me
Committed revision 18163.
It appears that this change caused a layout test regression: fast/frames/iframe-option-crash http://build.webkit.org/results/post-commit-powerpc-mac-os-x/4654/ http://build.webkit.org/post-commit-powerpc-mac-os-x/builds/4654/step-layout-test/0
(In reply to comment #5) > It appears that this change caused a layout test regression: > > fast/frames/iframe-option-crash > > http://build.webkit.org/results/post-commit-powerpc-mac-os-x/4654/ > http://build.webkit.org/post-commit-powerpc-mac-os-x/builds/4654/step-layout-test/0 Darn. I don't think this is a real regression -- I think I just need to update this test result. The point of the test is to check if you crash. I'll try to get to this tonight.
(In reply to comment #6) > I don't think this is a real regression -- I think I just need to update this > test result. The point of the test is to check if you crash. Layout test results fixed in r18167.