[webkit-reviews] review granted: [Bug 51914] ElementRareData::m_shadowRoot should not be RefPtr. : [Attachment 79396] Patch

[bugzilla-daemon at webkit.org]

David Levin <levin at chromium.org> has granted MORITA Hajime
<morrita at google.com>'s request for review:
Bug 51914: ElementRareData::m_shadowRoot should not be RefPtr.
https://bugs.webkit.org/show_bug.cgi?id=51914

Attachment 79396: Patch
https://bugs.webkit.org/attachment.cgi?id=79396&action=review

------- Additional Comments from David Levin <levin at chromium.org>
TreeShared is a little magical (the way that ref count goes to zero but it
stays alive because it has a parent).

I see how this is finally deleted now.	It happens in removeShadowRoot.  The
ref count goes to 1. Here:
   if (RefPtr<Node> oldRoot = data->m_shadowRoot) {

Then the parent is removed and when the "if" is exited, "oldRoot" is deref'ed
so the ref count goes to zero and there is no parent so the node is destroyed.

This is a bit tricky, but it seems fine. (I wonder if there should be some
comments somewhere about how lifetime is managed in here. It takes some
detective work to figure it all out.)

Please make sure to run debug test before submitting (and/or use the commit
queue).