[webkit-reviews] review denied: [Bug 3653] Safari crash on call to DOMImplementation.createDocumentType : [Attachment 2627] Don't assume that nodes always have a document pointer.

[bugzilla-request-daemon at opendarwin.org]

Darin Adler <darin at apple.com> has denied Anders Carlsson <andersca at mac.com>'s
request for review:
Bug 3653: Safari crash on call to DOMImplementation.createDocumentType
http://bugzilla.opendarwin.org/show_bug.cgi?id=3653

Attachment 2627: Don't assume that nodes always have a document pointer.
http://bugzilla.opendarwin.org/attachment.cgi?id=2627&action=edit

------- Additional Comments from Darin Adler <darin at apple.com>
Yes, DOMNode::mark() also needs to be updated to handle this case. If there's
no document, it should just take the early return that calls DOMObject::mark().


And DOMNode::getValueProperty needs an update too.

I'm thinking that patching each and every place that calls getDocument could be
a losing battle -- we might need to change the way document type nodes are
created to at least point them at a DocumentPtr that is 0 rather than having
the DocumentPtr itself be 0. There could be a single "always-0" DocumentPtr for
use in cases like that.

Once we do that we could revisit the things patched here -- we wouldn't have to
patch anything that checks the result of getDocument() for 0, only the things
that assume it's non-0.