[Webkit-unassigned] [Bug 19891] Broken HTML object elements cause de-reference of pointer to freed memory

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=19891





------- Comment #13 from chrisb at adobe.com  2008-07-25 09:34 PDT -------
(In reply to comment #12)
> Please land this with a test case! Ideally, the patch should include its test
> cases in LayoutTests.
> 

I can add a LayoutTest, but the LayoutTest would have to hit the network.  The
bug only happens if the we get a 404 response with a non-image content type
header.  Also, I'm not sure I know how to detect that the test failed other
than the ASSERT I added to WebCore::Frame's constructor.

The attached test case is a reduction of an existing LayoutTest:
LayoutTests/dom/html/level2/html/HTMLBodyElement08.html


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.