Creating a DOM track element by script and changing the mode crashes results in a browser crash.
Created attachment 159750 [details] Fix and test
Not sure if this is the best fix, but the spec doesn't have anything to say about combinations of DOM mutation and JS changes; Either way, we shouldn't crash, I'm open to suggestions.
isnt this a null pointer crash, if it yes, it is not a security bug
<rdar://problem/12147515>
(In reply to comment #3) > isnt this a null pointer crash, if it yes, it is not a security bug Indeed, it's just a null pointer crash; thought it might be more, initially.
Comment on attachment 159750 [details] Fix and test Rejecting attachment 159750 [details] from commit-queue. victor@rosedu.org does not have committer permissions according to http://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/committers.py. - If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags. - If you have committer rights please correct the error in Tools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed). The commit-queue restarts itself every 2 hours. After restart the commit-queue will correctly respect your committer rights.
Comment on attachment 159750 [details] Fix and test Clearing flags on attachment: 159750 Committed r126331: <http://trac.webkit.org/changeset/126331>
All reviewed patches have been landed. Closing bug.