-
oliver@apple.com authored
Bug 17015: REGRESSION (r29414-29428): www.fox.com "shows" menu fails to render Bug 17164: REGRESSION: JavaScript pop-up menu appears at wrong location when hovering image at http://news.chinatimes.com/ Reviewed by Oliver Hunt <http://bugs.webkit.org/show_bug.cgi?id=16889> <rdar://problem/5696255> <http://bugs.webkit.org/show_bug.cgi?id=17015> <http://bugs.webkit.org/show_bug.cgi?id=17164> <rdar://problem/5720947> The ActivationImp tear-off (r29425) introduced a problem with ReadModify nodes that first resolve a slot, call valueForReadModifyNode(), and then store a value in the previously resolved slot. Since valueForReadModifyNode() may cause a tear-off, the slot needs to be resolved again, but this was not happening with the existing code. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@29997 268f45cc-cd09-0410-ab3c-d52691b4dbfc
93359ecf