Fix for crash when assigning document.body

[Maciej Stachowiak]

On Oct 4, 2003, at 11:33 AM, Dirk Mueller wrote:

> On Saturday 04 October 2003 02:10, Maciej Stachowiak wrote:
>
>> Ah, I see. Yes, I've run into this before, and it's sort of on my
>> mental TODO list to rationalize the KHTML refcounting a bit.
>
> Argh, I was afraid that you would say that. Look, there is nothing 
> irrational
> about our refcounting sheme, and which sheme you consider irrational 
> pretty
> much depends on which books you read in your life before.

The biggest problem I have is not so much creating with a ref of 0, but 
the weird rule in TreeShared that an object is not destroyed until it's 
refcount is 0 *and* it has no parent, but only in deref. So the parent 
has to do setParent(0) and then deref() even if it did not originally 
ref(). So in fact refs and derefs don't add up. This is hugely 
confusing. I think straight refcounting would be better than this, the 
parent should just hold a ref instead of expecting the parent pointer 
to magically keep the object alive.

Also, I should add that KJS objects are not created with a refcount of 
1, they are created with the GC_ALLOWED flag unset, and the first time 
you ref the flag is set. So they are protected from GC until the first 
ref or until the flag is explicitly set.

Regards,
Maciej