From fd169e240cd57bf4e2eda41c4a3fcf6bb5c1f20b Mon Sep 17 00:00:00 2001
From: Marc Epard <mepard@me.com>
Date: Wed, 20 Jan 2016 10:28:10 -0600
Subject: [PATCH] Fix crash running subwindows test

See https://github.com/ariya/phantomjs/issues/13882
---
 src/phantom.cpp | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/phantom.cpp b/src/phantom.cpp
index 3bcb2f776e..df0126e71b 100644
--- a/src/phantom.cpp
+++ b/src/phantom.cpp
@@ -522,7 +522,15 @@ void Phantom::doExit(int code)
     emit aboutToExit(code);
     m_terminated = true;
     m_returnValue = code;
-    foreach(QPointer<WebPage> page, m_pages) {
+
+    // Iterate in reverse order so the first page is the last one scheduled for deletion.
+    // The first page is the root object, which will be invalidated when it is deleted.
+    // This causes an assertion to go off in BridgeJSC.cpp Instance::createRuntimeObject.
+    QListIterator<QPointer<WebPage> > i(m_pages);
+    i.toBack();
+    while (i.hasPrevious()) {
+        const QPointer<WebPage> page = i.previous();
+
         if (!page) {
             continue;
         }