Bug 130034

Summary:

REGRESSION (r159218): FrameView::layout() should destroy TemporaryChange<LayoutPhase> before destroying Ref<FrameView>

Product:

WebKit

Reporter:

Daniel Bates <dbates>

Component:

WebCore Misc.

Assignee:

Daniel Bates <dbates>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ddkilzer, hyatt, simon.fraser, zalan

Priority:

Keywords:

InRadar, Regression

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	ap: review+

Daniel Bates

Reported 2014-03-10 12:26:51 PDT

We should always destroy TemporaryChange<LayoutPhase> before destroying Ref<FrameView> in FrameView::layout() so as to ensure that the FrameView exists when we restore the original layout phase value.

Attachments
Patch (2.28 KB, patch) 2014-03-10 12:30 PDT, Daniel Bates	ap: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Daniel Bates

Comment 1 2014-03-10 12:27:04 PDT

<rdar://problem/15664288>

Daniel Bates

Comment 2 2014-03-10 12:30:34 PDT

Created attachment 226330 [details] Patch

alan

Comment 3 2014-03-10 12:50:50 PDT

Comment on attachment 226330 [details] Patch Looks good.

Daniel Bates

Comment 4 2014-03-10 12:56:49 PDT

Committed r165396: <http://trac.webkit.org/changeset/165396>

Note You need to log in before you can comment on or make changes to this bug.