Bug 106759

Summary:	StyleResolver::m_rootElementStyle could point to an already deleted RenderStyle
Product:	WebKit	Reporter:	Ilya Tikhonovsky <loislo>
Component:	CSS	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	apavlov, bfulgham, koivisto
Priority:	P2
Version:	528+ (Nightly build)
Hardware:	Unspecified
OS:	Unspecified

Ilya Tikhonovsky

Reported 2013-01-14 00:21:15 PST

I landed additional instrumentation for Native Memory snapshot and found that sometimes native memory profiler traverses through a document from a previous test which is not yet collected. StyleResolver from this document has m_rootElementStyle member which points to an already deleted RenderStyle.

Attachments
Add attachment proposed patch, testcase, etc.

Brent Fulgham

Comment 1 2022-07-13 12:03:46 PDT

We don't believe this is possible in modern WebKit.

Note You need to log in before you can comment on or make changes to this bug.