- From: Boris Zbarsky <bzbarsky@MIT.EDU>
- Date: Thu, 21 Jun 2012 17:31:50 -0400
- To: Allen Wirfs-Brock <allen@wirfs-brock.com>
- CC: "public-script-coord@w3.org" <public-script-coord@w3.org>
On 6/21/12 5:28 PM, Allen Wirfs-Brock wrote: > Well, if you know what insertBefore expects of its arguments you could > try to check that. But, really at that point it really is more > insertBefore's problem. Why, as its caller, are you trying to do its > work for it? Oh, insertBefore will happily throw as needed. That becomes your problem, as the caller, if you're using that DOM as your data model. >> In at least the cases I'm familiar with it only uses and depends on >> C++ code that web pages can't mess with. > > Right, and calling to into C++ code is a boundary crossing where you may > need to do additional checking because C++ doesn't guarantee memory safety. I'm not talking about memory safety. That's guaranteed for DOM consumers in practice by the runtime. -Boris
Received on Thursday, 21 June 2012 21:32:19 UTC