Crash on Orange media portal

Visit orange.deezer.com, press tab marked "My Music".
Browser crashes every time.

Pressing the button will trigger a re-layout of the page.
This in turn will cause some rendering nodes of type
RenderLayer to be removed from the rendering tree.
When such a node is removed, it is important to also
update certain lists in ancestor nodes that may hold references
to this node. A node that may hold such a reference is
identified as being a "stacking context".

However, in Android, when the symbol ENABLE_COMPOSITED_FIXED_ELEMENTS
is defined, the definition of what is a stacking context
is expanded. In this case, a node that is a stacking context
and holds references to descendants, changes one of the conditions
that form part of Android's expanded stacking context definition.
So, now it is no longer a stacking context, but the reference list
is not deleted/updated. When the descendant node is removed a
search for an ancestral stacking context is made, but it will
not find this node since it is no longer a stacking context.

The solution is to make sure that the list of references is
updated/cleared whenever the node changes a condition that
may cause its status as a stacking context to also change.

Change-Id: If5a7b63715020bc3d23749a7c09003a86d90e28d

0 files changed, 0 insertions, 0 deletions