Reviewed by Anders.
authorantti <antti@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 31 Aug 2007 22:09:03 +0000 (22:09 +0000)
committerantti <antti@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 31 Aug 2007 22:09:03 +0000 (22:09 +0000)
commitfc4e40b59fd853640001337c7e3aa7e0a9c6aa3e
tree0e10144d7c978b1c04830f25c3fa5ccded292782
parent35c07f38ca8a84a79d706402ac39349aaa3d41a3
    Reviewed by Anders.

        Fix <rdar://problem/5452943>
        REGRESSION (r25283): Reproducible crash in HTMLObjectElement::getInstance under guard malloc

        Calling updateLayoutIgnorePendingStylesheets() may do arbitrary things to render tree so
        no RenderObjects can be cached over it.

        * html/HTMLEmbedElement.cpp:
        (WebCore::findWidgetRenderer):
        (WebCore::HTMLEmbedElement::getInstance):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::getInstance):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@25334 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore/ChangeLog
WebCore/html/HTMLEmbedElement.cpp
WebCore/html/HTMLObjectElement.cpp