[Webkit-unassigned] [Bug 18971] Crash on sierpinski svg

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sat May 24 23:08:14 PDT 2008


http://bugs.webkit.org/show_bug.cgi?id=18971


darin at apple.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #21053|review?                     |review-
               Flag|                            |




------- Comment #3 from darin at apple.com  2008-05-24 23:08 PDT -------
(From update of attachment 21053)
+            Node *cloneParentPtr = cloneParent.get();

There's no guaranteed that this node won't go away due to DOM mutation code.
The local variable needs to be a RefPtr. And the result needs to be a
PassRefPtr<Node>, not a raw Node* pointer.

The test case should be included in the patch, too.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



More information about the webkit-unassigned mailing list