Bug 90133

Summary: REGRESSION(r121232): named properties on document and window may return wrong object
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: DOMAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: abarth, darin, haraken, japhet, jochen, kling, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 89923    
Bug Blocks:    
Attachments:
Description Flags
Patch
none
Patch none

Ryosuke Niwa
Reported 2012-06-27 21:54:17 PDT
Addressing Darin's comment on https://bugs.webkit.org/show_bug.cgi?id=89923: Comment #18 From Darin Adler 2012-06-26 11:57:21 PST (-) [reply] (From update of attachment 149455 [details]) View in context: https://bugs.webkit.org/attachment.cgi?id=149455&action=review >> Source/WebCore/html/HTMLCollection.h:65 >> + } > > This looks like it could return true for a list with two items if hasLength is false, m_cache.current is 2, and itemAfter(2) is 0. Is there some reason that’s not a problem? Sorry, let me say that again: This looks like it could return true for a collection with two items if m_cache.hasLength is false and m_cache.current is 1. If so, there is a bug here. If not, why can’t this happen?
Attachments
Patch (11.30 KB, patch)
2012-06-27 22:29 PDT, Ryosuke Niwa
no flags
Patch (6.98 KB, patch)
2012-06-27 22:30 PDT, Ryosuke Niwa
no flags
Ryosuke Niwa
Comment 1 2012-06-27 22:29:32 PDT
Ryosuke Niwa
Comment 2 2012-06-27 22:30:47 PDT
WebKit Review Bot
Comment 3 2012-06-28 12:48:46 PDT
Comment on attachment 149870 [details] Patch Clearing flags on attachment: 149870 Committed r121454: <http://trac.webkit.org/changeset/121454>
WebKit Review Bot
Comment 4 2012-06-28 12:48:52 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.