Changeset 18335 in webkit

Timestamp:

Dec 19, 2006, 10:00:38 PM (18 years ago)

Author:

andersca

Message:

LayoutTests:

Reviewed by Adele.

<rdar://problem/4726407>
[9A255] Crash in WebCore::EventTargetNode::dispatchEvent

• fast/dom/resources/script-element-gc.js: Added.
• fast/dom/script-element-gc-expected.txt: Added.
• fast/dom/script-element-gc.html: Added.

WebCore:

Reviewed by Adele.

<rdar://problem/4726407>
[9A255] Crash in WebCore::EventTargetNode::dispatchEvent

• html/HTMLScriptElement.cpp: (WebCore::HTMLScriptElement::notifyFinished): Ref the script element while running the script since it can be freed when executing the script.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/resources/script-element-gc.js (added)
• LayoutTests/fast/dom/script-element-gc-expected.txt (added)
• LayoutTests/fast/dom/script-element-gc.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLScriptElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2006-12-19  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Adele.
+
+        <rdar://problem/4726407>
+        [9A255] Crash in WebCore::EventTargetNode::dispatchEvent
+
+        * fast/dom/resources/script-element-gc.js: Added.
+        * fast/dom/script-element-gc-expected.txt: Added.
+        * fast/dom/script-element-gc.html: Added.
+
 2006-12-19  Justin Garcia  <justin.garcia@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2006-12-19  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Adele.
+
+        <rdar://problem/4726407> 
+        [9A255] Crash in WebCore::EventTargetNode::dispatchEvent
+        
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::notifyFinished):
+        Ref the script element while running the script since it can be freed
+        when executing the script.
+
 2006-12-19  Darin Adler  <darin@apple.com>
 

trunk/WebCore/html/HTMLScriptElement.cpp

@@ -146 +146 @@
     assert(cs == m_cachedScript);
 
+    // Evaluating the script could lead to a garbage collection which
+    // can delete the script element so we need to protect it.
+    RefPtr<HTMLScriptElement> protect(this);
+    
     if (cs->errorOccurred())
         dispatchHTMLEvent(errorEvent, true, false);