[Webkit-unassigned] [Bug 17956] possible write to freed memory in EventTargetNode::dispatchSimulatedMouseEvent()

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Apr 1 17:44:09 PDT 2008


------- Comment #3 from adele at apple.com  2008-04-01 17:44 PDT -------
I've been trying to create a test case where the node gets destroyed that
early, and I've been unsuccessful.  I think its because the Event keeps a
RefPtr to the EventTarget...and dispatchSimulatedClick has a RefPtr for the
event, so the event and the target node can't get destroyed until after
dispatchSimulatedClick exits.  Someone should check my logic on that though...

Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

More information about the webkit-unassigned mailing list