Bug 35398

Summary:

Race condition in JSPropertyNameIterator and Structure destruction

Product:

WebKit

Reporter:

Oliver Hunt <oliver>

Component:

New Bugs

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

Other

OS:

OS X 10.5

Attachments:

Description	Flags
Patch	mjs: review+

Description Oliver Hunt 2010-02-25 12:10:48 PST

Race condition in JSPropertyNameIterator and Structure destruction

Comment 1 Oliver Hunt 2010-02-25 12:21:53 PST

Created attachment 49516 [details]
Patch

Comment 2 Maciej Stachowiak 2010-02-25 12:28:53 PST

Comment on attachment 49516 [details]
Patch

r=me

Comment 3 Darin Adler 2010-02-25 12:45:50 PST

Comment on attachment 49516 [details]
Patch

> +        void setCachedStructure(Structure* structure)

How about PassRefPtr for this argument?

Comment 4 Oliver Hunt 2010-02-25 14:15:38 PST

Committed r55256: <http://trac.webkit.org/changeset/55256>