Crash in RenderScrollbarPart::imageChanged.
https://bugs.webkit.org/show_bug.cgi?id=68009 Reviewed by Simon Fraser. Source/WebCore: When a custom scrollbar is removed from its FrameView, its destruction can be delayed because of RefPtr maintained in EventHandler class (m_lastScrollbarUnderMouse). Upon removal, we delete all the scrollbar parts so that they don't link back to scrollbar. However, because of the delay, we can have a call to updateScrollbarPart which recreates it. When scrollbar is getting destroyed, we just check to see if there are remaining scrollbar parts and if yes, we destroy them. Test: scrollbars/scrollbar-part-created-with-no-parent-crash.html * rendering/RenderScrollbar.cpp: (WebCore::RenderScrollbar::~RenderScrollbar): LayoutTests: * scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt: Added. * scrollbars/scrollbar-part-created-with-no-parent-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95074 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Showing with 94 additions and 1 deletion