[webkit-reviews] review requested: [Bug 7855] REGRESSION: document.open() in a script added through document.write() causes a crash : [Attachment 7307] proposed fix

[bugzilla-request-daemon at opendarwin.org]

Alexey Proskuryakov <ap at nypop.com> has asked  for review:
Bug 7855: REGRESSION: document.open() in a script added through
document.write() causes a crash
http://bugzilla.opendarwin.org/show_bug.cgi?id=7855

Attachment 7307: proposed fix
http://bugzilla.opendarwin.org/attachment.cgi?id=7307&action=edit

------- Additional Comments from Alexey Proskuryakov <ap at nypop.com>
The problem here was that Node::deref() was expecting nodeExtraRefCounts to
exist, which was not necessarily true.

Rather than adding yet another check, I've streamlined the code to make
newNodes and nodeExtraRefCounts always exist after the first Node is
constructed. Hopefully, less branching will result in slightly better
performance.

Making an automated test for this doesn't seem possible.