[Webkit-unassigned] [Bug 43166] InsertOrderedList does not switch the list type properly when it has an inner list.

Thu Jul 29 17:34:13 PDT 2010

https://bugs.webkit.org/show_bug.cgi?id=43166

Ryosuke Niwa <rniwa at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #63000|0                           |1
        is obsolete|                            |
  Attachment #63017|                            |review?
               Flag|                            |

--- Comment #7 from Ryosuke Niwa <rniwa at webkit.org>  2010-07-29 17:34:13 PST ---
Created an attachment (id=63017)
 --> (https://bugs.webkit.org/attachment.cgi?id=63017)
fixed mergeWithNeighboringLists

(In reply to comment #6)
> If DOM mutation events can run while we make changes, then this code is unsafe. After either of the two calls to mergeIdenticalElements returns, listElement or nextList might be pointing to a deleted object. Thus, they should both be RefPtr or PassRefPtr.

A good point.

> Calling nextElementSibling after handling previousList would be another way of avoiding using a possibly-bad nextList pointer, but it wouldn't help you safely return nextList after calling mergeIdenticalElements, so I think you need a RefPtr.

Oh right, I feel like I encountered a bug like that a year ago.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.