[Webkit-unassigned] [Bug 9683] Implement select.options.remove() method

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sat Nov 24 19:22:50 PST 2007


mjs at apple.com changed:

           What    |Removed                     |Added
  Attachment #17490|review?                     |review-
               Flag|                            |

------- Comment #12 from mjs at apple.com  2007-11-24 19:22 PDT -------
(From update of attachment 17490)
I think this has a potential bug. If you retrieve select.options on a select,
then remove it from the document and let a GC happen, this line will crash
because the wrapper will already have been GC'd:

+    JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(toJS(exec,

Please add a test case along those lines and if it indeed causes a crash where
I expect please fix patch appropriately (you may have to duplicate the custom
logic from HTMLSelectElement.

Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

More information about the webkit-unassigned mailing list