diff options
| author | Ben Murdoch <benm@google.com> | 2010-05-06 15:49:14 +0100 |
|---|---|---|
| committer | Ben Murdoch <benm@google.com> | 2010-05-06 15:54:34 +0100 |
| commit | 7f034a1734d634dd1fdb3b64817d5828b5e46922 (patch) | |
| tree | 4cc1831e32d1da542cbc63fbf327c37844e28528 /WebCore/page/chromium | |
| parent | da713c0266664dc15b021e99cca31cadc5bd2bdc (diff) | |
| download | external_webkit-7f034a1734d634dd1fdb3b64817d5828b5e46922.zip external_webkit-7f034a1734d634dd1fdb3b64817d5828b5e46922.tar.gz external_webkit-7f034a1734d634dd1fdb3b64817d5828b5e46922.tar.bz2 | |
Fix a ref counting bug in touch event handling. The RefPtr returned from m_originatingTouchPointTargets.take() was only in scope
for the duration of the else block but we saved the raw pointer it wrapped. When the else block ended, the RefPtr destroyed itself, also
deleting it's enclosed pointer if it held the final ref. But we had a saved copy of this raw pointer and then went on to use
it later.
Fix bug 2543728.
Change-Id: I90e17693e15bff0969f103b5947d004837189c44
Diffstat (limited to 'WebCore/page/chromium')
0 files changed, 0 insertions, 0 deletions