17956 2008-03-19 14:14:27 -0700 possible write to freed memory in EventTargetNode::dispatchSimulatedMouseEvent() 2009-08-12 16:49:42 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows XP RESOLVED WORKSFORME InRadar P2 Normal --- 1 eroman webkit-unassigned adele ddkilzer koivisto mrowe oldest_to_newest 74468 0 eroman 2008-03-19 14:14:27 -0700 Not certain about this, but it looks like if the event handler deletes the node within dispatchSimulatedMouseEvent(), there can be a subsequent assignment to freed memory: EventTargetNode::dispatchSimulatedMouseEvent(...) { ... m_dispatchingSimulatedEvent = true; // <--- The event handler may end up deleting "this" ---> dispatchMouseEvent(...); // <--- Could this assignment happen to freed memory? ---> m_dispatchingSimulatedEvent = false; } I ran into a problem when using an access key that deleted the anchor (LayoutTests/fast/events/access-key-self-destruct.html) -- however I am not certain if there were other modifications in my code that could have caused this problem. Can someone familiar with the method comment if this is a problem? (I see that EventTargetNode::dispatchMouseEvent() protects "this" from deletion, why does this block not require it too?) 74469 1 mrowe 2008-03-19 14:19:58 -0700 It should be possible to construct a test case which crashes due to this issue. It may require GuardMalloc to be enabled to reproducibly crash though. 74470 2 mrowe 2008-03-19 14:20:10 -0700 <rdar://problem/5808517> 76097 3 adele 2008-04-01 17:44:08 -0700 I've been trying to create a test case where the node gets destroyed that early, and I've been unsuccessful. I think its because the Event keeps a RefPtr to the EventTarget...and dispatchSimulatedClick has a RefPtr for the event, so the event and the target node can't get destroyed until after dispatchSimulatedClick exits. Someone should check my logic on that though... 80648 4 eric 2008-05-16 13:50:33 -0700 The m_dispatchingSimulatedMouseEvent bool is gone from TOT. This bug can be closed. 139652 5 ddkilzer 2009-08-12 16:49:42 -0700 (In reply to comment #4) > The m_dispatchingSimulatedMouseEvent bool is gone from TOT. This bug can be > closed. The m_dispatchingSimulatedEvent bool was removed in r31767. <http://trac.webkit.org/changeset/31767>