Skip to content
  • darin's avatar
    LayoutTests: · 568a23ac
    darin authored
            Reviewed by Darin.
    
            - test for http://bugs.webkit.org/show_bug.cgi?id=12353
              REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element)
    
            * fast/dom/HTMLImageElement/constructor-mutation-event-dispatch-expected.txt: Added.
            * fast/dom/HTMLImageElement/constructor-mutation-event-dispatch.html: Added.
    
    WebCore:
    
            Reviewed by Darin.
    
            - fix http://bugs.webkit.org/show_bug.cgi?id=12353 <rdar://problem/4944599>
              REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element)
        
            Test: fast/dom/HTMLImageElement/constructor-mutation-event-dispatch.html
    
            * bindings/js/kjs_html.cpp:
            (KJS::ImageConstructorImp::construct): Protect the image element before setting
            its attributes.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@19018 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    568a23ac