|Summary:||TOT REGRESSION: Crash in cloneChildNodes when clicking element|
|Product:||WebKit||Reporter:||Denis Defreyne <amonre>|
|Component:||DOM||Assignee:||Darin Adler <darin>|
|OS:||OS X 10.4|
Description Denis Defreyne 2006-01-17 12:34:53 PST
Comment 2 Geoffrey Garen 2006-01-17 13:04:50 PST
Confirmed on TOT.
Comment 3 Geoffrey Garen 2006-01-17 13:14:00 PST
All you have to do to reproduce this crash is click the word "Discussion." It seems to have an onclick handler that does funny things.
Comment 4 Joost de Valk (AlthA) 2006-01-22 04:37:47 PST
Adding Regression keyword.
Comment 5 Darin Adler 2006-01-23 00:27:53 PST
I think I can fix this with some RefPtr. Working on it.
Comment 6 Darin Adler 2006-01-23 02:33:01 PST
I have a fix, but would be nice to have a test case for layout tests too.
Comment 7 Darin Adler 2006-01-23 02:48:57 PST
Created attachment 5866 [details] use PassRefPtr for cloneNode -- made the bug go away
Comment 8 Anders Carlsson 2006-01-23 03:40:29 PST
I could reproduce the crash by modifying fast/dom/clone-node-form-elements.html to make <input id="input2" type="checkbox"> read <input id="input2" type="checkbox" checked="checked">
Comment 9 John Sullivan 2006-01-23 07:32:41 PST
Comment on attachment 5866 [details] use PassRefPtr for cloneNode -- made the bug go away It might be a good idea to check for leaks in the layout tests. Otherwise r=me.
Comment 10 Darin Adler 2006-01-23 09:00:11 PST
I checked for leaks, and found and fixed one. There are more leaks remaining, but they don't relate to what I just changed.
Comment 11 Eric Seidel (no email) 2006-01-31 21:20:44 PST
Removing Regression keyword from bugs already fixed.