Bug 62836 – REGRESSION (r89035): HTMLTableRowsCollection constructor crashes; depends on compiler order of evaluation

• Component: DOM
• Status: RESOLVED FIXED

[Darin Adler]

This code is wrong:

HTMLTableRowsCollection::HTMLTableRowsCollection(PassRefPtr<HTMLTableElement> table)
    : HTMLCollection(table, OtherCollection, table->collectionCache())
{
}

If the first argument is evaluated first, then the second may dereference null because of the semantics of PassRefPtr. The fix is simple.

[Darin Adler]

Created attachment 97533 [details]
Patch

[Darin Adler]

Committed r89096: <http://trac.webkit.org/changeset/89096>

[Alexey Proskuryakov]

Should the HTMLTableRowsCollection constructor just be changed to take a raw pointer?

[Darin Adler]

(In reply to comment #3)
> Should the HTMLTableRowsCollection constructor just be changed to take a raw pointer?

Since the function does take ownership of a reference, the PassRefPtr optimization works, so I think it's good to take a smart pointer, even though in this case we can’t take advantage of it.

[Alexey Proskuryakov]

The only caller of HTMLTableRowsCollection::create() passes "this" to this function, and I don't see how any caller could possibly pass ownership of HTMLTableElement to HTMLTableRowsCollection.

[Darin Adler]

(In reply to comment #5)
> The only caller of HTMLTableRowsCollection::create() passes "this" to this function, and I don't see how any caller could possibly pass ownership of HTMLTableElement to HTMLTableRowsCollection.

RefPtr implements a shared ownership model. The function does take ownership.

On the other hand, if nobody ever takes advantage of it, I think it’s fine to use raw pointers instead.