[Webkit-unassigned] [Bug 108223] [Mac] Flaky crash in SliderThumbElement::defaultEventHandler on fast/forms/range/slider-delete-while-dragging-thumb.html

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=108223





--- Comment #9 from Elliott Sprehn <esprehn at chromium.org>  2013-03-21 00:38:38 PST ---
I'll see if I cycle back around on this soon. I think the issue is that EventHandler has a reference to this shadow node with m_capturingMouseEventsNode (or a related property) and then the input is torn down but the EventHandler isn't cleaned up. That's the only way I can figure that shadowHost() can be 0.

I think we might want to reconsider how we implement form controls though. In JS when you're using Shadow DOM we have lots of protections and a restricted life cycle. Inside the C++ widgets we make a lot of assumptions about the structure of the widget which is dangerous.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.