Crash on Frame::inScope() part 2
authormorrita@google.com <morrita@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Oct 2012 08:00:16 +0000 (08:00 +0000)
committermorrita@google.com <morrita@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Oct 2012 08:00:16 +0000 (08:00 +0000)
commita7b1790df60ea57c28cd48903c9226f887fe976e
tree67650ea29b6f97fa97addca5575ac254a86a08cf
parent07a3a78a2e5b551ededc2362266cfc67602d8ca4
Crash on Frame::inScope() part 2
https://bugs.webkit.org/show_bug.cgi?id=99543

Reviewed by Kent Tamura.

FrameTree::scopedChildCount() can be called even when the one of child frames
is in orphan state. This change added a guard for that case.

No new tests. A hard-to-test timing issue.

* page/Frame.cpp:
(WebCore::Frame::inScope):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@131561 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/page/Frame.cpp