In TextureMapperNode::syncCompositingStateSelf in ParentChange "if" statement m_parent gets overwritten 1st and node gets removed from new m_parent child list and never added. In ChildrenChange m_children list gets cleared, but m_parent members of child nodes are not cleared. This cause unsync in m_children <-> m_parent linkage and random crashes mostly ~TextureMapperNode(), but also in other places when already deallocated node gets referenced because it wasn't removed from child list.
Created attachment 96991 [details] Fix parent/children unsync in TextureMapperNode.
Comment on attachment 96991 [details] Fix parent/children unsync in TextureMapperNode. View in context: https://bugs.webkit.org/attachment.cgi?id=96991&action=review > Source/WebCore/ChangeLog:10 > + Unofficially reviewed by Noam Rosenthal (module author). This is now an official review, so please remove this line before committing.
Created attachment 101122 [details] Updated Changelog by Noams request.
Comment on attachment 101122 [details] Updated Changelog by Noams request. Clearing flags on attachment: 101122 Committed r91192: <http://trac.webkit.org/changeset/91192>
All reviewed patches have been landed. Closing bug.