Skip to content
  •'s avatar
    AX: Heap-use-after-free when deleting a ContainerNode with an AX object · a09b3cd4 authored
    Reviewed by Hajime Morita.
    Calls axObjectCache()->remove(this) in ~ContainerNode so that the AX tree
    doesn't try to access the container node while walking up the parent chain
    from one of the container node's children.
    Test: accessibility/container-node-delete-causes-crash.html
    * dom/ContainerNode.cpp:
    * dom/Node.cpp:
    * dom/Node.h:
    Adds test for heap-use-after-free when container node with AX object is deleted.
    * accessibility/container-node-delete-causes-crash-expected.txt: Added.
    * accessibility/container-node-delete-causes-crash.html: Added.
    git-svn-id: 268f45cc-cd09-0410-ab3c-d52691b4dbfc