Reviewed by Maciej.

        fix for <rdar://problem/4127101> REGRESSION(412-TOT) crash when creating Option element

        * khtml/ecma/kjs_html.cpp: (KJS::OptionConstructorImp::construct):
        Changed ElementImpl pointer to a SharedPtr because it was getting destroyed before we were done with it.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@9185 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index 5d51669e170ca284c33825f9dc7fac018847f345..d156c8bfe8206e6a77f79e721f98425d786e95a8 100644 (file)
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,3 +1,12 @@
+2005-05-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Maciej.
+
+        fix for <rdar://problem/4127101> REGRESSION(412-TOT) crash when creating Option element
+
+        * khtml/ecma/kjs_html.cpp: (KJS::OptionConstructorImp::construct):
+        Changed ElementImpl pointer to a SharedPtr because it was getting destroyed before we were done with it.  
+
 2005-05-20  John Sullivan  <sullivan@apple.com>
 
         Reviewed by Chris.

diff --git a/WebCore/khtml/ecma/kjs_html.cpp b/WebCore/khtml/ecma/kjs_html.cpp
index 6858fac9744e5a4638394dd02427155929c559a1..dda30f5a7ba7b8819311828e60bfea88ea540a1a 100644 (file)
--- a/WebCore/khtml/ecma/kjs_html.cpp
+++ b/WebCore/khtml/ecma/kjs_html.cpp
@@ -3341,11 +3341,10 @@ bool OptionConstructorImp::implementsConstruct() const
 Object OptionConstructorImp::construct(ExecState *exec, const List &args)
 {
   int exception = 0;
-  ElementImpl *el = m_doc->createElement("option", exception);
+  SharedPtr<ElementImpl> el(m_doc->createElement("option", exception));
   HTMLOptionElementImpl *opt = 0;
-  if (el) {
-    el->ref();
-    opt = static_cast<HTMLOptionElementImpl *>(el);
+  if (el.notNull()) {
+    opt = static_cast<HTMLOptionElementImpl *>(el.get());
     int sz = args.size();
     TextImpl *t = m_doc->createTextNode("");
     t->ref();
@@ -3359,7 +3358,6 @@ Object OptionConstructorImp::construct(ExecState *exec, const List &args)
     if (exception == 0 && sz > 3)
       opt->setSelected(args[3].toBoolean(exec));
     t->deref();
-    el->deref();
   }
 
   setDOMException(exec, exception);