[Bug 116457] [PATCH] Correct DOM script causes konqueror to crash

[Germain Garand]

Le Mardi 13 Décembre 2005 10:21, Ivor Hewitt a écrit :
> > +            if (lineBoxParent != this)
> > +                m_marker = 0;
> >          }
> >      }
> >  }
>
> Control of the m_marker has been passed to the lineBoxParent just above
> so that change should be o.k.

I wouldn't be so positive. The ownership flag is only there to prevent 
detachment of a not yet inserted marker, between a setStyle and a first 
updateMarkerPosition (and that looks a bit cheesy, btw). 

Otherwise, the listItem is still fully responsible for updates of the marker 
position in the render tree. The patch breaks that relationship, so would 
create multiple markers on relayout AFAICS.

But since the source of problem here is destruction of the marker before its 
listItem, we should rather make sure a marker nulls its reference within the 
listItem when detached.

Will try to attach a patch to the BR shortly, feel free to beat me to it.

Germain