[webkit-reviews] review granted: [Bug 30049] Manipulating DOM from a script while parsing XHTML can cause a crash : [Attachment 41883] proposed fix

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has granted Alexey Proskuryakov <ap at webkit.org>'s
request for review:
Bug 30049: Manipulating DOM from a script while parsing XHTML can cause a crash
https://bugs.webkit.org/show_bug.cgi?id=30049

Attachment 41883: proposed fix
https://bugs.webkit.org/attachment.cgi?id=41883&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
> +	   (WebCore::XMLTokenizer::setCurrentNode): Push the new node onto
stack. If null is passed,
> +	   then we're aborting; nuke the whole stack.

It seems strange to give setCurrentNode(0) this special behavior. Perhaps
instead we could use a separate functions for this purpose. One could be called
pushNode and the other could be called something else.

> +	   (WebCore::XMLTokenizer::popCurrentNode): This is now called instead
of setCurrentNode when
> +	   exiting a node.

I'm not sure why the word "current" is needed in the name of this function.

r=me as is, but please consider getting rid of the two different meanings for
setCurrentNode.