[webkit-reviews] review denied: [Bug 57897] Crash in WebCore::RenderMathMLSubSup::baselinePosition() : [Attachment 92668] Updated patch with property changelog entry.

[bugzilla-daemon at webkit.org]

Beth Dakin <bdakin at apple.com> has denied Alex Milowski <alex at milowski.com>'s
request for review:
Bug 57897: Crash in WebCore::RenderMathMLSubSup::baselinePosition()
https://bugs.webkit.org/show_bug.cgi?id=57897

Attachment 92668: Updated patch with property changelog entry.
https://bugs.webkit.org/attachment.cgi?id=92668&action=review

------- Additional Comments from Beth Dakin <bdakin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=92668&action=review

I think the bug fix here is compelling, but I think we should just fix the
crash with this bug. Since Jeffrey posted a patch just to fix the crash, I
think I will r+ that, and we should file a new bug for the rendering issue you
are working on here.

> Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp:69
> +	       position++;

Our style-guide dictates that there should be braces around this for-loop since
it contains more than one line of code. Also, is it necessary to compare the
nodeType() to Node::ELEMENT_NODE? Can you just ask current->isElementNode()?

> Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp:73
> +	   RenderMathMLBlock* wrapper = new (renderArena())
RenderMathMLBlock(node());

How do you know this is always position 1? Is there a way to break this?