[Webkit-unassigned] [Bug 16782] REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Jan 9 23:22:08 PST 2008


http://bugs.webkit.org/show_bug.cgi?id=16782





------- Comment #11 from mitz at webkit.org  2008-01-09 23:22 PDT -------
(In reply to comment #6)
> I don't know if this bug can be triggered outside of a LayoutTest.  I don't
> know of a programmatic way to click an anchor element in WebKit (Opera provides
> a click() method).

You can do it in WebKit by dispatching a mouse click DOM event to the element.
When the document is replaced, scriptable objects are invalidated, which
destroys the underlying runtime objects (in the case of the bug, the event
sender object). So I do not know if the bug can be triggered without a native
object, but I think it can happen with plug-ins as well, if they trigger the
replacement.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



More information about the webkit-unassigned mailing list