:( .. which in turn ruins our brand new no-copy scheme. Have a layout test. Coming up in a sec.
Created attachment 42338 [details] Layout Test/Reduction
I guess we need to store a pointer to a vector, instead of a vector, in the event target's hash table.
<rdar://problem/7358150>
Just to avoid double-work... Geoffrey, are you working on this or am I :)?
Vitaly wins the straw poll!
Created attachment 42371 [details] patch: proposed fix
Created attachment 42376 [details] patch: proposed fix v2
You probably need to also include my test in your patch.
Created attachment 42402 [details] patch: proposed fix v3 (now includes the test)
I think Geoff should review this.
Comment on attachment 42402 [details] patch: proposed fix v3 (now includes the test) r=me Please update your ChangeLogs to match the title of this bug.
Created attachment 42546 [details] patch: proposed fix v4
(In reply to comment #11) > (From update of attachment 42402 [details]) > r=me > > Please update your ChangeLogs to match the title of this bug. Done.
Comment on attachment 42546 [details] patch: proposed fix v4 great!
Comment on attachment 42546 [details] patch: proposed fix v4 Also needs to build with USE(JSC) == 1.
Created attachment 42583 [details] patch: proposed fix v5
(In reply to comment #15) > (From update of attachment 42546 [details]) > Also needs to build with USE(JSC) == 1. Oops. Done.
Comment on attachment 42583 [details] patch: proposed fix v5 r=Geof and me.
Landed as http://trac.webkit.org/changeset/50573.