[webkit-reviews] review denied: [Bug 9683] Implement select.options.remove() method : [Attachment 17490] Implement select.options.remove() method

[bugzilla-daemon at webkit.org]

Maciej Stachowiak <mjs at apple.com> has denied David Kilzer (ddkilzer)
<ddkilzer at webkit.org>'s request for review:
Bug 9683: Implement select.options.remove() method
http://bugs.webkit.org/show_bug.cgi?id=9683

Attachment 17490: Implement select.options.remove() method
http://bugs.webkit.org/attachment.cgi?id=17490&action=edit

------- Additional Comments from Maciej Stachowiak <mjs at apple.com>
I think this has a potential bug. If you retrieve select.options on a select,
then remove it from the document and let a GC happen, this line will crash
because the wrapper will already have been GC'd:

+    JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(toJS(exec,
imp->base()));

Please add a test case along those lines and if it indeed causes a crash where
I expect please fix patch appropriately (you may have to duplicate the custom
logic from HTMLSelectElement.