[webkit-reviews] review requested: [Bug 43166] InsertOrderedList does not switch the list type properly when it has an inner list. : [Attachment 63017] fixed mergeWithNeighboringLists

[bugzilla-daemon at webkit.org]

Ryosuke Niwa <rniwa at webkit.org> has asked  for review:
Bug 43166: InsertOrderedList does not switch the list type properly when it has
an inner list.
https://bugs.webkit.org/show_bug.cgi?id=43166

Attachment 63017: fixed mergeWithNeighboringLists
https://bugs.webkit.org/attachment.cgi?id=63017&action=review

------- Additional Comments from Ryosuke Niwa <rniwa at webkit.org>
(In reply to comment #6)
> If DOM mutation events can run while we make changes, then this code is
unsafe. After either of the two calls to mergeIdenticalElements returns,
listElement or nextList might be pointing to a deleted object. Thus, they
should both be RefPtr or PassRefPtr.

A good point.

> Calling nextElementSibling after handling previousList would be another way
of avoiding using a possibly-bad nextList pointer, but it wouldn't help you
safely return nextList after calling mergeIdenticalElements, so I think you
need a RefPtr.

Oh right, I feel like I encountered a bug like that a year ago.