[Webkit-unassigned] [Bug 143521] [GTK] Crash in DOMObjectCache when a wrapped object owned by the cache is unreffed by the user

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=143521

Martin Robinson <mrobinson at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #250347|review?                     |review+
              Flags|                            |

--- Comment #2 from Martin Robinson <mrobinson at webkit.org> ---
Comment on attachment 250347
  --> https://bugs.webkit.org/attachment.cgi?id=250347
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=250347&action=review

> Source/WebCore/ChangeLog:13
> +        try to remove more references that what the object actually has,

Nit: that what -> than what

> Source/WebCore/bindings/gobject/DOMObjectCache.cpp:48
> +        cacheReferences = std::min(static_cast<unsigned>(object->ref_count), cacheReferences);

It might be worth dropping a comment here explaining why cacheReferences might be incorrect at this point.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150408/d9d079dd/attachment.html>