[webkit-reviews] review requested: [Bug 12353] REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element) : [Attachment 12586] Protect the image element from deletion during mutation event dispatch

[bugzilla-request-daemon at macosforge.org]

mitz at webkit.org has asked  for review:
Bug 12353: REGRESSION: Crash on load (mutation event dispatch under the image
element constructor deletes the element)
http://bugs.webkit.org/show_bug.cgi?id=12353

Attachment 12586: Protect the image element from deletion during mutation event
dispatch
http://bugs.webkit.org/attachment.cgi?id=12586&action=edit

------- Additional Comments from mitz at webkit.org
I don't know if it makes sense for the calls to setWidth and setHeight to on
the newly created element to even fire DOM mutation events, but this patch
ensures that the element survives it, and in any case it makes sense to take
ownership of the element before doing anything with it.