[Webkit-unassigned] [Bug 12704] New: Crash after dragging image from window to window with onunload handlers

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=12704

           Summary: Crash after dragging image from window to window with
                    onunload handlers
           Product: WebKit
           Version: 420+ (nightly)
          Platform: All
        OS/Version: Mac OS X 10.4
            Status: UNCONFIRMED
          Severity: Critical
          Priority: P1
         Component: WebCore JavaScript
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: tom at bungeelabs.com


This crash is partially reproducible and *feels* like a race condition.
Sometimes the test-case reduction crashes the browser, but other times it
doesn't. The test-case reduction does the following:

1) Main window script opens new window.
2) Drag image from new window into main window.
3) Main window document onUnload event fires as image is loaded.
4) Main window onUnload handler closes new window.
5) Main window and new window send notification of closure to server.
6) The dragged image appears briefly as the document in the main window.
7) *Crash*


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.