DescriptionOilpan: Fix crashes in ~CSSGroupingRule()
We observe crashes in fast/dom/css-delete-doc.html.
The cause is that ~CSSGroupingRule() touches m_childRuleCSSOMWrappers.
~CSSGroupingRule() shouldn't touch m_childRuleCSSOMWrappers because the wrappers are on the heap.
NOTRY=true
R=ager@chromium.org, wibling@chromium.org
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168374
Patch Set 1 #Patch Set 2 : #
Total comments: 1
Messages
Total messages: 10 (0 generated)
|