Bug 24325 - Crash on replacing document contents during drop
Summary: Crash on replacing document contents during drop
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Windows XP
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-03-03 09:48 PST by Scott Violet
Modified: 2009-03-03 13:13 PST (History)
0 users

See Also:


Attachments
Fix for 24325 (4.11 KB, patch)
2009-03-03 09:53 PST, Scott Violet
no flags Details | Formatted Diff | Diff
Fix for 24325 (4.06 KB, patch)
2009-03-03 12:26 PST, Scott Violet
eric: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Scott Violet 2009-03-03 09:48:15 PST
I came across this when tracking down another crash. If you have a DOM mutation event listener and it replaces the entire contents of the document during a drop, we crash. I know, this is contrived, but it's a crash none the less.
Comment 1 Scott Violet 2009-03-03 09:53:38 PST
Created attachment 28226 [details]
Fix for 24325
Comment 2 Eric Seidel (no email) 2009-03-03 11:53:39 PST
Comment on attachment 28226 [details]
Fix for 24325

This looks fine.  I'm surprised that the test case needs to use waitUntilDone()

Ideally the test case should also set the text to PASSED when it's done.  The blank page would confuse me at first.
Comment 3 Scott Violet 2009-03-03 12:26:48 PST
Created attachment 28234 [details]
Fix for 24325

Changes output to be PASSED and removes waitForDone/NotifyDone.
Comment 4 Eric Seidel (no email) 2009-03-03 12:28:11 PST
Comment on attachment 28234 [details]
Fix for 24325

Looks fine.
Comment 5 Dimitri Glazkov (Google) 2009-03-03 13:13:17 PST
Landed as http://trac.webkit.org/changeset/41403.