Bug 35398 - Race condition in JSPropertyNameIterator and Structure destruction
Summary: Race condition in JSPropertyNameIterator and Structure destruction
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Other OS X 10.5
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-02-25 12:10 PST by Oliver Hunt
Modified: 2010-02-25 14:15 PST (History)
0 users

See Also:


Attachments
Patch (6.49 KB, patch)
2010-02-25 12:21 PST, Oliver Hunt
mjs: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2010-02-25 12:10:48 PST
Race condition in JSPropertyNameIterator and Structure destruction
Comment 1 Oliver Hunt 2010-02-25 12:21:53 PST
Created attachment 49516 [details]
Patch
Comment 2 Maciej Stachowiak 2010-02-25 12:28:53 PST
Comment on attachment 49516 [details]
Patch

r=me
Comment 3 Darin Adler 2010-02-25 12:45:50 PST
Comment on attachment 49516 [details]
Patch

> +        void setCachedStructure(Structure* structure)

How about PassRefPtr for this argument?
Comment 4 Oliver Hunt 2010-02-25 14:15:38 PST
Committed r55256: <http://trac.webkit.org/changeset/55256>