I'm filing this bug in case a WebKit open source contributer would like something easy to chew on that will take them throughout a large section of the code. We have this template SharedPtr<T> which is used for automatically ref()ing and deref()ing "Shared" objects. SharedPtr behaves pretty much just like a normal pointer and can be used either as an instance variable, or as a local variable for keeping track of a ref to an object. SharedPtr automatically initializes itself to 0 in it's default constructor, as well as will automatically ref on assignment and deref on clearing or when going out of scope. In order to find all the places in which SharePtr should be applied in the khtml code, simply search for "deref()". SharePtr works with any object supporting ref()/deref() calls, not just those deriving from Shared, however, as you witll note, there are certain objects which take arguments on ref() or deref() which are not compatible with SharedPtr. At time of writing there 342 manual deref() calls in khtml. Most (if not all) of those could be replaced by proper SharePtr usage, for not only cleaner, smaller code, but possibly also bug fixes. We've found numerous ref counting issues in WebCore before, which have often been fixed by adoping SharedPtr.
There are significantly fewer manual derefs now, and not all of these can be easily removed, but many are still waiting :-)
I think we can declare this as fixed now, closing.