Description
Experienced crash when clicking mouse and holding mouse button, then unloading the document then releasing mouse.
Traced it to Element->GetOwnerDocument() owner_document is cached for child elements, but when that document is gone, you have a dangling pointer in the child.
(When you click mouse element is placed in list inside Context.cpp, when doc unloads element survives as refcount in increased, but owner_document is not reset, while document itself is deleted.)
My version of Element->GetOwnerDocument():
// Gets the document this element belongs to.
ElementDocument* Element::GetOwnerDocument()
{
if (owner_document) {
return owner_document;
}
return parent? parent->GetOwnerDocument():nullptr;
}
Another solution could be to reset owner_document variable of all children when a document unloads.