[webkit-reviews] review granted: [Bug 12353] REGRESSION: Crash on
load (mutation event dispatch under the image element
constructor deletes the element) : [Attachment 12586] Protect
the image element from deletion during mutation event dispatch
bugzilla-request-daemon at macosforge.org
bugzilla-request-daemon at macosforge.org
Sun Jan 21 13:53:06 PST 2007
Darin Adler <darin at apple.com> has granted Darin Adler <darin at apple.com>'s
request for review:
Bug 12353: REGRESSION: Crash on load (mutation event dispatch under the image
element constructor deletes the element)
http://bugs.webkit.org/show_bug.cgi?id=12353
Attachment 12586: Protect the image element from deletion during mutation event
dispatch
http://bugs.webkit.org/attachment.cgi?id=12586&action=edit
------- Additional Comments from Darin Adler <darin at apple.com>
An equally good way to fix this would be to put the newly-created image element
into a RefPtr; that's the model we're trying to move to. Reference-counted
objects won't have an initial floating state -- instead they go straight into a
PassRefPtr.
But this fix is also good. r=me
More information about the webkit-reviews
mailing list