[Webkit-unassigned] [Bug 12353] REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element)

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sun Jan 21 11:32:52 PST 2007


mitz at webkit.org changed:

           What    |Removed                     |Added
  Attachment #12586|                            |review?
               Flag|                            |

------- Comment #6 from mitz at webkit.org  2007-01-21 11:32 PDT -------
Created an attachment (id=12586)
 --> (http://bugs.webkit.org/attachment.cgi?id=12586&action=view)
Protect the image element from deletion during mutation event dispatch

I don't know if it makes sense for the calls to setWidth and setHeight to on
the newly created element to even fire DOM mutation events, but this patch
ensures that the element survives it, and in any case it makes sense to take
ownership of the element before doing anything with it.

Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

More information about the webkit-unassigned mailing list