Bug 35398

Summary: Race condition in JSPropertyNameIterator and Structure destruction
Product: WebKit Reporter: Oliver Hunt <oliver>
Component: New BugsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Other   
OS: OS X 10.5   
Attachments:
Description Flags
Patch mjs: review+

Description Oliver Hunt 2010-02-25 12:10:48 PST
Race condition in JSPropertyNameIterator and Structure destruction
Comment 1 Oliver Hunt 2010-02-25 12:21:53 PST
Created attachment 49516 [details]
Patch
Comment 2 Maciej Stachowiak 2010-02-25 12:28:53 PST
Comment on attachment 49516 [details]
Patch

r=me
Comment 3 Darin Adler 2010-02-25 12:45:50 PST
Comment on attachment 49516 [details]
Patch

> +        void setCachedStructure(Structure* structure)

How about PassRefPtr for this argument?
Comment 4 Oliver Hunt 2010-02-25 14:15:38 PST
Committed r55256: <http://trac.webkit.org/changeset/55256>