[Webkit-unassigned] [Bug 16782] REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Jan 9 23:22:08 PST 2008
http://bugs.webkit.org/show_bug.cgi?id=16782
------- Comment #11 from mitz at webkit.org 2008-01-09 23:22 PDT -------
(In reply to comment #6)
> I don't know if this bug can be triggered outside of a LayoutTest. I don't
> know of a programmatic way to click an anchor element in WebKit (Opera provides
> a click() method).
You can do it in WebKit by dispatching a mouse click DOM event to the element.
When the document is replaced, scriptable objects are invalidated, which
destroys the underlying runtime objects (in the case of the bug, the event
sender object). So I do not know if the bug can be triggered without a native
object, but I think it can happen with plug-ins as well, if they trigger the
replacement.
--
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
More information about the webkit-unassigned
mailing list