[Webkit-unassigned] [Bug 25567] Crash when writing into a detached TITLE element

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=25567





--- Comment #19 from MORITA Hajime <morrita at google.com>  2010-03-31 05:11:36 PST ---
Updated patch. 
original code causes unexpected DOM mutation during addChild(), 
that make addChild() fail,  that causes crash. 
This patch prevent such implicit mutation. for HTMLTitleElement. 
now addChild() really append a new child.

BTW on parsing issue, I file it on Bug 31881 because that is not only for
<title> and
I think we should tackle it separately.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.