-
darin authored
Reviewed by Darin. - test for http://bugs.webkit.org/show_bug.cgi?id=12353 REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element) * fast/dom/HTMLImageElement/constructor-mutation-event-dispatch-expected.txt: Added. * fast/dom/HTMLImageElement/constructor-mutation-event-dispatch.html: Added. WebCore: Reviewed by Darin. - fix http://bugs.webkit.org/show_bug.cgi?id=12353 <rdar://problem/4944599> REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element) Test: fast/dom/HTMLImageElement/constructor-mutation-event-dispatch.html * bindings/js/kjs_html.cpp: (KJS::ImageConstructorImp::construct): Protect the image element before setting its attributes. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@19018 268f45cc-cd09-0410-ab3c-d52691b4dbfc
568a23ac