[webkit-reviews] review requested: [Bug 9683] Implement select.options.remove() method : [Attachment 17510] Patch v2

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sun Nov 25 11:19:44 PST 2007

David Kilzer (ddkilzer) <ddkilzer at webkit.org> has asked  for review:
Bug 9683: Implement select.options.remove() method

Attachment 17510: Patch v2

------- Additional Comments from David Kilzer (ddkilzer) <ddkilzer at webkit.org>
(In reply to comment #12)
> (From update of attachment 17490 [edit])
> I think this has a potential bug. If you retrieve select.options on a select,

> then remove it from the document and let a GC happen, this line will crash
> because the wrapper will already have been GC'd:
> +    JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(toJS(exec,

> imp->base()));
> Please add a test case along those lines and if it indeed causes a crash
> I expect please fix patch appropriately (you may have to duplicate the custom

> logic from HTMLSelectElement.

I've added a test (LayoutTests/fast/js/select-options-remove-gc.html) for the
condition described above.  However, I couldn't get WebKit to crash either in
the browser (using the "Caches Window" between removing select and using
options.remove()) or in a layout test.

Otherwise, there are no changes in this patch compared to Attachment #17490.

More information about the webkit-reviews mailing list