[Webkit-unassigned] [Bug 26044] Crash at Node::nodeIndex()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=26044


eric at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|eric at webkit.org             |webkit-
                   |                            |unassigned at lists.webkit.org




------- Comment #13 from eric at webkit.org  2009-06-03 13:39 PDT -------
Actually, looks like we always attach ranges,and only detach them when they
have a m_start.container().  That seems like this code:

for (var x = 0; x < 10000; x++)
   document.createRange();

would end up with lots of attached Ranges which never got detached.

Going to see if I can make a crashing test case. :)


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.