Bug 28732

Summary: r47744 causes media/video-controls-with-mutation-event-handler.html to crash
Product: WebKit Reporter: Eric Carlson <eric.carlson>
Component: WebCore Misc.Assignee: Eric Carlson <eric.carlson>
Status: RESOLVED FIXED    
Severity: Normal CC: hclam, levin
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: All   
Attachments:
Description Flags
proposed patch mitz: review+

Description Eric Carlson 2009-08-25 22:08:00 PDT 
https://bugs.webkit.org/show_bug.cgi?id=28241 caused media/video-controls-with-mutation-event-handler.html to begin crashing on Windows, eg. http://build.webkit.org/results/Windows%20Release%20(Tests)/r47770%20(3743)/results.html. 

The crash happens when the MediaControlVolumeSliderElement constructor calls setAttribute() in a page with registered mutation event listeners. setAttribute() causes a synchronous event to be fired immediately and the event destructor derefs the event target (the MediaControlVolumeSliderElement) so the element is destroyed before the constructor returns.
Comment 1 Eric Carlson 2009-08-25 22:43:05 PDT 
Created attachment 38598 [details]
proposed patch
Comment 2 Eric Carlson 2009-08-25 22:50:29 PDT 
http://trac.webkit.org/changeset/47774