[webkit-reviews] review denied: [Bug 22357] Crash when setting className from js : [Attachment 25932] Potential patch for issue 22357

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has denied Glenn Wilson <gwilson at google.com>'s
request for review:
Bug 22357: Crash when setting className from js
https://bugs.webkit.org/show_bug.cgi?id=22357

Attachment 25932: Potential patch for issue 22357
https://bugs.webkit.org/attachment.cgi?id=25932&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
The class attribute itself is supposed to be a mapped attribute. It's not OK
that we can't get class names -- that means that CSS styles that are based on
class won't work! If hasClass is true, but there's no mapped attributes
pointer, then something strange is going on.

Looking at the test case it looks like the key here is that the class name is
being set by SVG "baseValue" code. I think that means that the SVG code is not
setting the attribute properly, and that's resulting in the object being in a
strange state. It's that animation code incorrectly setting the attribute that
needs to be fixed, not the CSS selector matching code.

If the change was correct and was needed in this function, then it would also
be needed in CSSStyleSelector::SelectorChecker::checkOneSelector.