[Webkit-unassigned] [Bug 33983] Setting <Select>.options.length to remove elements is broken if the page has (or ever had) DOM mutation events registered

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=33983





--- Comment #4 from Alexey Proskuryakov <ap at webkit.org>  2010-01-22 23:33:26 PST ---
-        const Vector<Element*>& items = listItems();
+        const Vector<Element*> items = listItems();

This fixes vector iteration. What guarantees that elements don't get deleted,
making pointers in the vector stale?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.