[Webkit-unassigned] [Bug 17956] possible write to freed memory in EventTargetNode::dispatchSimulatedMouseEvent()

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=17956





------- Comment #3 from adele at apple.com  2008-04-01 17:44 PDT -------
I've been trying to create a test case where the node gets destroyed that
early, and I've been unsuccessful.  I think its because the Event keeps a
RefPtr to the EventTarget...and dispatchSimulatedClick has a RefPtr for the
event, so the event and the target node can't get destroyed until after
dispatchSimulatedClick exits.  Someone should check my logic on that though...


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.