Commit df7df08b authored by ap@apple.com's avatar ap@apple.com
Browse files

Reviewed by Brian Weinstein.

        REGRESSION (r83081): Use of deallocated memory in WebEditorClient::respondToChangedSelection()
        https://bugs.webkit.org/show_bug.cgi?id=58082

        * WebProcess/WebCoreSupport/WebEditorClient.cpp: (WebKit::WebEditorClient::respondToChangedSelection):
        Now that the Range is used outside the full expression where it's created, it needs to be
        protected with RefPtr.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@83211 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent d62e44d7
2011-04-07 Alexey Proskuryakov <ap@apple.com>
Reviewed by Brian Weinstein.
REGRESSION (r83081): Use of deallocated memory in WebEditorClient::respondToChangedSelection()
https://bugs.webkit.org/show_bug.cgi?id=58082
* WebProcess/WebCoreSupport/WebEditorClient.cpp: (WebKit::WebEditorClient::respondToChangedSelection):
Now that the Range is used outside the full expression where it's created, it needs to be
protected with RefPtr.
2011-04-07 Mark Rowe <mrowe@apple.com>
Reviewed by Dan Bernstein.
......
......@@ -198,11 +198,11 @@ void WebEditorClient::respondToChangedSelection()
selectionState.isInPasswordField = frame->selection()->isInPasswordField();
selectionState.hasComposition = frame->editor()->hasComposition();
Range* range = frame->selection()->toNormalizedRange().get();
RefPtr<Range> range = frame->selection()->toNormalizedRange();
if (range) {
size_t location;
size_t length;
if (!TextIterator::locationAndLengthFromRange(range, location, length))
if (!TextIterator::locationAndLengthFromRange(range.get(), location, length))
return;
selectionState.selectedRangeStart = static_cast<uint64_t>(location);
selectionState.selectedRangeLength = static_cast<uint64_t>(length);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment