28732 2009-08-25 22:08:00 -0700 r47744 causes media/video-controls-with-mutation-event-handler.html to crash 2009-08-25 22:50:42 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) PC All RESOLVED FIXED P2 Normal --- 1 eric.carlson eric.carlson hclam levin oldest_to_newest 142783 0 eric.carlson 2009-08-25 22:08:00 -0700 https://bugs.webkit.org/show_bug.cgi?id=28241 caused media/video-controls-with-mutation-event-handler.html to begin crashing on Windows, eg. http://build.webkit.org/results/Windows%20Release%20(Tests)/r47770%20(3743)/results.html. The crash happens when the MediaControlVolumeSliderElement constructor calls setAttribute() in a page with registered mutation event listeners. setAttribute() causes a synchronous event to be fired immediately and the event destructor derefs the event target (the MediaControlVolumeSliderElement) so the element is destroyed before the constructor returns. 142787 1 38598 eric.carlson 2009-08-25 22:43:05 -0700 Created attachment 38598 proposed patch 142790 2 eric.carlson 2009-08-25 22:50:29 -0700 http://trac.webkit.org/changeset/47774 38598 2009-08-25 22:43:05 -0700 2009-08-25 22:44:16 -0700 proposed patch patch.txt text/plain 2132 eric.carlson SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA0Nzc3MikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMDktMDgtMjUgIEVyaWMgQ2FybHNvbiAgPGVyaWMuY2FybHNvbkBh cHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgcjQ3NzQ0IGNhdXNlcyBtZWRpYS92aWRlby1jb250cm9scy13aXRoLW11dGF0aW9uLWV2ZW50 LWhhbmRsZXIuaHRtbCB0byBjcmFzaAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9Mjg3MzIKKworICAgICAgICAqIHJlbmRlcmluZy9NZWRpYUNvbnRyb2xF bGVtZW50cy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpNZWRpYUNvbnRyb2xWb2x1bWVTbGlkZXJF bGVtZW50OjpNZWRpYUNvbnRyb2xWb2x1bWVTbGlkZXJFbGVtZW50KToKKyAgICAgICAgICAgICBE b24ndCBjYWxsIHNldEF0dHJpYnV0ZSBmcm9tIHRoZSBjb25zdHJ1dG9yLCBhbnkgcmVnaXN0ZXJl ZCBtdXRhdGlvbiBldmVudCAKKyAgICAgICAgICAgICBsaXN0ZW5lciB3aWxsIGNhdXNlIGEgY3Jh c2guCisgCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlck1lZGlhLmNwcDoKKyAgICAgICAgKFdl YkNvcmU6OlJlbmRlck1lZGlhOjpjcmVhdGVWb2x1bWVTbGlkZXIpOgorICAgICAgICAgICAgIFNl dCB0aGUgbWF4QXR0ciBoZXJlIGluc3RlYWQgb2YgaW4gdGhlIGNvbnN0cnVjdG9yLgorCiAyMDA5 LTA4LTI1ICBEbWl0cnkgVGl0b3YgIDxkaW1pY2hAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJl dmlld2VkIGJ5IEJyYWR5IEVpZHNvbi4KSW5kZXg6IFdlYkNvcmUvcmVuZGVyaW5nL01lZGlhQ29u dHJvbEVsZW1lbnRzLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3JlbmRlcmluZy9NZWRpYUNv bnRyb2xFbGVtZW50cy5jcHAJKHJldmlzaW9uIDQ3NzYzKQorKysgV2ViQ29yZS9yZW5kZXJpbmcv TWVkaWFDb250cm9sRWxlbWVudHMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC02MjgsNyArNjI4LDYg QEAgdm9pZCBNZWRpYUNvbnRyb2xUaW1lbGluZUVsZW1lbnQ6OnVwZGF0ZQogTWVkaWFDb250cm9s Vm9sdW1lU2xpZGVyRWxlbWVudDo6TWVkaWFDb250cm9sVm9sdW1lU2xpZGVyRWxlbWVudChEb2N1 bWVudCogZG9jdW1lbnQsIEhUTUxNZWRpYUVsZW1lbnQqIGVsZW1lbnQpCiAgICAgOiBNZWRpYUNv bnRyb2xJbnB1dEVsZW1lbnQoZG9jdW1lbnQsIE1FRElBX0NPTlRST0xTX1ZPTFVNRV9TTElERVIs ICJyYW5nZSIsIGVsZW1lbnQpCiB7Ci0gICAgc2V0QXR0cmlidXRlKG1heEF0dHIsICIxIik7CiB9 CiAKIHZvaWQgTWVkaWFDb250cm9sVm9sdW1lU2xpZGVyRWxlbWVudDo6ZGVmYXVsdEV2ZW50SGFu ZGxlcihFdmVudCogZXZlbnQpCkluZGV4OiBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJNZWRpYS5j cHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTWVkaWEuY3BwCShyZXZp c2lvbiA0Nzc2MykKKysrIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck1lZGlhLmNwcAkod29ya2lu ZyBjb3B5KQpAQCAtMjU3LDYgKzI1Nyw3IEBAIHZvaWQgUmVuZGVyTWVkaWE6OmNyZWF0ZVZvbHVt ZVNsaWRlcigpCiAgICAgQVNTRVJUKCFtX3ZvbHVtZVNsaWRlcik7CiAgICAgbV92b2x1bWVTbGlk ZXIgPSBuZXcgTWVkaWFDb250cm9sVm9sdW1lU2xpZGVyRWxlbWVudChkb2N1bWVudCgpLCBtZWRp YUVsZW1lbnQoKSk7CiAgICAgbV92b2x1bWVTbGlkZXItPnNldEF0dHJpYnV0ZShwcmVjaXNpb25B dHRyLCAiZmxvYXQiKTsKKyAgICBtX3ZvbHVtZVNsaWRlci0+c2V0QXR0cmlidXRlKG1heEF0dHIs ICIxIik7CiAgICAgbV92b2x1bWVTbGlkZXItPmF0dGFjaFRvUGFyZW50KG1fdm9sdW1lU2xpZGVy Q29udGFpbmVyLmdldCgpKTsKIH0KIAo=