At one stage in the tear down of web page, the compositor is disconnected from the web page so WebPageCompositorPrivate::m_webPage is 0. However, WebPageCompositorPrivate::render() doesn't check validity of m_webPage before calling into WebPage::compositor() to see if we're really the web page's compositor.
This is PR164943
Created attachment 147169 [details] Patch
Comment on attachment 147169 [details] Patch LGTM.
Comment on attachment 147169 [details] Patch Clearing flags on attachment: 147169 Committed r120134: <http://trac.webkit.org/changeset/120134>
All reviewed patches have been landed. Closing bug.