RESOLVED FIXED 34899
[V8] Crash regression in r54305 when window.event is set by a script 
https://bugs.webkit.org/show_bug.cgi?id=34899
Summary [V8] Crash regression in r54305 when window.event is set by a script
Nate Chapin
Reported 2010-02-12 10:11:13 PST
ScriptController.cpp:174 doesn't handle the possibility that the event field on the global object is set to a v8::Object that isn't a DOM wrapper. This can only happen if a script has directly set window.event.
Attachments
patch (5.18 KB, patch)
2010-02-12 10:23 PST, Nate Chapin 		eric: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Nate Chapin
Comment 1 2010-02-12 10:23:33 PST
Created attachment 48651 [details] patch
Eric Seidel (no email)
Comment 2 2010-02-17 16:15:20 PST
Comment on attachment 48651 [details] patch Ideally fast/dom/Window/window-event-override-no-crash.html should have a newline at the end, but this looks great!
Note You need to log in before you can comment on or make changes to this bug.