[webkit-reviews] review granted: [Bug 12353] REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element) : [Attachment 12586] Protect the image element from deletion during mutation event dispatch

bugzilla-request-daemon at macosforge.org bugzilla-request-daemon at macosforge.org
Sun Jan 21 13:53:06 PST 2007


Darin Adler <darin at apple.com> has granted Darin Adler <darin at apple.com>'s
request for review:
Bug 12353: REGRESSION: Crash on load (mutation event dispatch under the image
element constructor deletes the element)
http://bugs.webkit.org/show_bug.cgi?id=12353

Attachment 12586: Protect the image element from deletion during mutation event
dispatch
http://bugs.webkit.org/attachment.cgi?id=12586&action=edit

------- Additional Comments from Darin Adler <darin at apple.com>
An equally good way to fix this would be to put the newly-created image element
into a RefPtr; that's the model we're trying to move to. Reference-counted
objects won't have an initial floating state -- instead they go straight into a
PassRefPtr.

But this fix is also good. r=me



More information about the webkit-reviews mailing list