4716 2005-08-28 11:18:38 -0700 NodeIterator will crash if the filter function removes the current node from the document 2019-02-06 09:02:35 -0800 1 1 1 Unclassified WebKit DOM 420+ Mac OS X 10.4 RESOLVED FIXED P2 Normal --- 1 darin darin cdumez ian oldest_to_newest 17813 0 darin 2005-08-28 11:18:38 -0700 Code inspection of functions like NodeIteratorImpl::findNextNode make it clear that the NodeIterator does not do correct memory management of the nodes. As it iterates through nodes, the function holds a node pointer across a call to arbitrary JavaScript without calling ref() on that node. Clearly that can lead to a crash. 66636 1 darin 2008-01-08 22:52:26 -0800 Bug 3492 now has a patch that addresses this. 69760 2 darin 2008-02-08 02:36:13 -0800 Committed revision 30089. 1502803 3 lforschler 2019-02-06 09:02:35 -0800 Mass moving XML DOM bugs to the "DOM" Component.