[Webkit-unassigned] [Bug 90133] New: REGRESSION(r121232): named properties on document and window may return wrong object
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Jun 27 21:54:19 PDT 2012
https://bugs.webkit.org/show_bug.cgi?id=90133
Summary: REGRESSION(r121232): named properties on document and
window may return wrong object
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: HTML DOM
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: rniwa at webkit.org
CC: darin at apple.com, kling at webkit.org
Depends on: 89923
Addressing Darin's comment on https://bugs.webkit.org/show_bug.cgi?id=89923:
Comment #18 From Darin Adler 2012-06-26 11:57:21 PST (-) [reply]
(From update of attachment 149455 [details])
View in context: https://bugs.webkit.org/attachment.cgi?id=149455&action=review
>> Source/WebCore/html/HTMLCollection.h:65
>> + }
>
> This looks like it could return true for a list with two items if hasLength is false, m_cache.current is 2, and itemAfter(2) is 0. Is there some reason that’s not a problem?
Sorry, let me say that again:
This looks like it could return true for a collection with two items if m_cache.hasLength is false and m_cache.current is 1. If so, there is a bug here. If not, why can’t this happen?
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list