[Webkit-unassigned] [Bug 9683] Implement select.options.remove() method

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sun Nov 25 11:19:44 PST 2007


http://bugs.webkit.org/show_bug.cgi?id=9683


ddkilzer at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #17490|0                           |1
        is obsolete|                            |
         AssignedTo|webkit-                     |ddkilzer at webkit.org
                   |unassigned at lists.webkit.org |
             Status|NEW                         |ASSIGNED
  Attachment #17510|                            |review?
               Flag|                            |




------- Comment #14 from ddkilzer at webkit.org  2007-11-25 11:19 PDT -------
Created an attachment (id=17510)
 --> (http://bugs.webkit.org/attachment.cgi?id=17510&action=view)
Patch v2

(In reply to comment #12)
> (From update of attachment 17490 [edit])
> I think this has a potential bug. If you retrieve select.options on a select,
> then remove it from the document and let a GC happen, this line will crash
> because the wrapper will already have been GC'd:
> 
> +    JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(toJS(exec,
> imp->base()));
> 
> Please add a test case along those lines and if it indeed causes a crash where
> I expect please fix patch appropriately (you may have to duplicate the custom
> logic from HTMLSelectElement.

I've added a test (LayoutTests/fast/js/select-options-remove-gc.html) for the
condition described above.  However, I couldn't get WebKit to crash either in
the browser (using the "Caches Window" between removing select and using
options.remove()) or in a layout test.

Otherwise, there are no changes in this patch compared to Attachment #17490.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are the assignee for the bug, or are watching the assignee.



More information about the webkit-unassigned mailing list