Summary: | REGRESSION: crash when loading page w/ <link> that has a DOMSubtreeModified event listener | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Adele Peterson <adele> | ||||||||
Component: | DOM | Assignee: | Adele Peterson <adele> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | cdumez, mjs | ||||||||
Priority: | P1 | ||||||||||
Version: | 420+ | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.4 | ||||||||||
Attachments: |
|
Description
Adele Peterson
2006-01-30 14:54:33 PST
Created attachment 6120 [details]
crashing test case
this does not crash with Safari-417.8
I'm working on a patch. Created attachment 6121 [details]
patch
While debugging, I saw the event get destroyed, and then my node, which was an AttrImpl, getting destroyed. This patch fixes my test case.
Comment on attachment 6121 [details]
patch
uh oh. I think this causes some leaks. I'll have to rethink it.
Comment on attachment 6121 [details]
patch
I think this patch is correct, so if it causes a leak, I would expect it would be a bug elsewhere.
Last patch doesn't work because AttrImpl has a reference to it's AttributeImpl I'm trying to find some way to ref the AttrImpl in NamedAttrMapImpl::getNamedItem so that the AttrImpl stays around long enough, but I haven't been able to get anything to work. The trick here is that the AttributeImpl must be retained when appendChildNode is called on it. I have a patch in the works. Created attachment 6311 [details]
patch
new and improved patch.
Comment on attachment 6311 [details]
patch
r=me
Nice work
Mass moving XML DOM bugs to the "DOM" Component. |