Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
W
webkit
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 0
    • Issues 0
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 0
    • Merge Requests 0
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • CI / CD
    • Repository
    • Value Stream
  • Wiki
    • Wiki
  • External Wiki
    • External Wiki
  • Members
    • Members
  • Collapse sidebar
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
  • App_Technologies
  • webkit
  • Repository

Switch branch/tag
  • webkit
  • Source
  • WebCore
  • page
  • DOMSelection.h
Find file BlameHistoryPermalink
  • rniwa@webkit.org's avatar
    Use-after-free in DOMSelection::containsNode · 886d1158
    rniwa@webkit.org authored May 22, 2013
    https://bugs.webkit.org/show_bug.cgi?id=116468
    
    Reviewed by Andreas Kling.
    
    Source/WebCore: 
    
    Retain the node pointer. Also bail out early if the node was not in the document
    since Range::compareBoundaryPoints sets ec to WRONG_DOCUMENT_ERR otherwise.
    
    Test: editing/selection/contains-node-crash.html
    
    * page/DOMSelection.cpp:
    (WebCore::DOMSelection::containsNode):
    * page/DOMSelection.h:
    (DOMSelection):
    
    LayoutTests: 
    
    Add a regression test from https://chromium.googlesource.com/chromium/blink/+/40bb8089352b15dd034641b4c131111cd79b44f1.
    
    * editing/selection/contains-node-crash-expected.txt: Added.
    * editing/selection/contains-node-crash.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150498 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    886d1158
DOMSelection.h 4.3 KB
EditWeb IDE

Replace DOMSelection.h

Attach a file by drag & drop or click to upload


Cancel
A new branch will be created in your fork and a new merge request will be started.