I spotted a crash that occurs when a page load occurs in the middle of processing a scroll event that has been propagated to a subframe that is destroyed by the page load. Alas reproducing requires malloc scribble, and a timer driven load independent of webcore.
Created attachment 26922 [details] Add a protector Simple fix
Comment on attachment 26922 [details] Add a protector r=me
Committing to http://svn.webkit.org/repository/webkit/trunk ... M WebCore/ChangeLog M WebCore/page/EventHandler.cpp Committed r40112