[Webkit-unassigned] [Bug 12353] REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element)

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=12353


darin at apple.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #12586|review?                     |review+
               Flag|                            |




------- Comment #8 from darin at apple.com  2007-01-21 13:53 PDT -------
(From update of attachment 12586)
An equally good way to fix this would be to put the newly-created image element
into a RefPtr; that's the model we're trying to move to. Reference-counted
objects won't have an initial floating state -- instead they go straight into a
PassRefPtr.

But this fix is also good. r=me


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.