-
Committer:
Chris Coulson
-
Date:
2014-03-28 12:29:32 UTC
-
Revision ID:
chris.coulson@canonical.com-20140328122932-2k6izmelr97o208x
When our RenderViewHost is swapped out, Chromium attaches the new RVH to the frame tree before notifying us of the swap. This means that the FrameTreeNode's corresponding to our WebFrame's have been deleted when we delete our frame tree, resulting in WebFrame::frame_tree_node_ being left dangling. Modify WebFrame to not store a pointer to its corresponding FrameTreeNode. This fixes a memory corruption bug