Bug 62836 - REGRESSION (r89035): HTMLTableRowsCollection constructor crashes; depends on compiler order of evaluation
Summary: REGRESSION (r89035): HTMLTableRowsCollection constructor crashes; depends on ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: Darin Adler
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-06-16 18:10 PDT by Darin Adler
Modified: 2011-06-17 09:25 PDT (History)
1 user (show)

See Also:


Attachments
Patch (1.68 KB, patch)
2011-06-16 18:15 PDT, Darin Adler
mitz: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Darin Adler 2011-06-16 18:10:59 PDT
This code is wrong:

HTMLTableRowsCollection::HTMLTableRowsCollection(PassRefPtr<HTMLTableElement> table)
    : HTMLCollection(table, OtherCollection, table->collectionCache())
{
}

If the first argument is evaluated first, then the second may dereference null because of the semantics of PassRefPtr. The fix is simple.
Comment 1 Darin Adler 2011-06-16 18:15:16 PDT
Created attachment 97533 [details]
Patch
Comment 2 Darin Adler 2011-06-16 18:17:04 PDT
Committed r89096: <http://trac.webkit.org/changeset/89096>
Comment 3 Alexey Proskuryakov 2011-06-16 22:40:31 PDT
Should the HTMLTableRowsCollection constructor just be changed to take a raw pointer?
Comment 4 Darin Adler 2011-06-17 08:20:02 PDT
(In reply to comment #3)
> Should the HTMLTableRowsCollection constructor just be changed to take a raw pointer?

Since the function does take ownership of a reference, the PassRefPtr optimization works, so I think it's good to take a smart pointer, even though in this case we can’t take advantage of it.
Comment 5 Alexey Proskuryakov 2011-06-17 09:00:10 PDT
The only caller of HTMLTableRowsCollection::create() passes "this" to this function, and I don't see how any caller could possibly pass ownership of HTMLTableElement to HTMLTableRowsCollection.
Comment 6 Darin Adler 2011-06-17 09:25:49 PDT
(In reply to comment #5)
> The only caller of HTMLTableRowsCollection::create() passes "this" to this function, and I don't see how any caller could possibly pass ownership of HTMLTableElement to HTMLTableRowsCollection.

RefPtr implements a shared ownership model. The function does take ownership.

On the other hand, if nobody ever takes advantage of it, I think it’s fine to use raw pointers instead.