58082 2011-04-07 14:36:27 -0700 REGRESSION (r83081): Use of deallocated memory in WebEditorClient::respondToChangedSelection() 2011-04-07 14:43:21 -0700 1 1 1 Unclassified WebKit WebKit Misc. 528+ (Nightly build) Mac OS X 10.6 RESOLVED FIXED P1 Normal --- 1 ap ap rsesek oldest_to_newest 381717 0 ap 2011-04-07 14:36:27 -0700 There is nothing protecting the range object. This used to not be a problem before this patch because temporary objects in C++ are deleted after the full expression is evaluated, so it wasn't destroyed until after the function call. Patch forthcoming. 381719 1 88702 ap 2011-04-07 14:39:09 -0700 Created attachment 88702 proposed fix 381723 2 88702 bweinstein 2011-04-07 14:41:37 -0700 Comment on attachment 88702 proposed fix View in context: https://bugs.webkit.org/attachment.cgi?id=88702&action=review > Source/WebKit2/ChangeLog:9 > + Now that the Range is used outide the full expression where it's created, it needs to be Typo: outside. 381726 3 ap 2011-04-07 14:43:21 -0700 Committed <http://trac.webkit.org/changeset/83211>. 88702 2011-04-07 14:39:09 -0700 2011-04-07 14:41:37 -0700 proposed fix RefPtr.txt text/plain 1845 ap SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDgzMjEwKQorKysgU291cmNlL1dlYktpdDIvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTEtMDQtMDcgIEFsZXhleSBQ cm9za3VyeWFrb3YgIDxhcEBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgUkVHUkVTU0lPTiAocjgzMDgxKTogVXNlIG9mIGRlYWxsb2Nh dGVkIG1lbW9yeSBpbiBXZWJFZGl0b3JDbGllbnQ6OnJlc3BvbmRUb0NoYW5nZWRTZWxlY3Rpb24o KQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTgwODIK KworICAgICAgICAqIFdlYlByb2Nlc3MvV2ViQ29yZVN1cHBvcnQvV2ViRWRpdG9yQ2xpZW50LmNw cDogKFdlYktpdDo6V2ViRWRpdG9yQ2xpZW50OjpyZXNwb25kVG9DaGFuZ2VkU2VsZWN0aW9uKToK KyAgICAgICAgTm93IHRoYXQgdGhlIFJhbmdlIGlzIHVzZWQgb3V0aWRlIHRoZSBmdWxsIGV4cHJl c3Npb24gd2hlcmUgaXQncyBjcmVhdGVkLCBpdCBuZWVkcyB0byBiZQorICAgICAgICBwcm90ZWN0 ZWQgd2l0aCBSZWZQdHIuCisKIDIwMTEtMDQtMDcgIE1hcmsgUm93ZSAgPG1yb3dlQGFwcGxlLmNv bT4KIAogICAgICAgICBSZXZpZXdlZCBieSBEYW4gQmVybnN0ZWluLgpJbmRleDogU291cmNlL1dl YktpdDIvV2ViUHJvY2Vzcy9XZWJDb3JlU3VwcG9ydC9XZWJFZGl0b3JDbGllbnQuY3BwCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIFNvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViQ29yZVN1cHBvcnQvV2ViRWRp dG9yQ2xpZW50LmNwcAkocmV2aXNpb24gODMyMDMpCisrKyBTb3VyY2UvV2ViS2l0Mi9XZWJQcm9j ZXNzL1dlYkNvcmVTdXBwb3J0L1dlYkVkaXRvckNsaWVudC5jcHAJKHdvcmtpbmcgY29weSkKQEAg LTE5OCwxMSArMTk4LDExIEBAIHZvaWQgV2ViRWRpdG9yQ2xpZW50OjpyZXNwb25kVG9DaGFuZ2Vk U2UKICAgICBzZWxlY3Rpb25TdGF0ZS5pc0luUGFzc3dvcmRGaWVsZCA9IGZyYW1lLT5zZWxlY3Rp b24oKS0+aXNJblBhc3N3b3JkRmllbGQoKTsKICAgICBzZWxlY3Rpb25TdGF0ZS5oYXNDb21wb3Np dGlvbiA9IGZyYW1lLT5lZGl0b3IoKS0+aGFzQ29tcG9zaXRpb24oKTsKIAotICAgIFJhbmdlKiBy YW5nZSA9IGZyYW1lLT5zZWxlY3Rpb24oKS0+dG9Ob3JtYWxpemVkUmFuZ2UoKS5nZXQoKTsKKyAg ICBSZWZQdHI8UmFuZ2U+IHJhbmdlID0gZnJhbWUtPnNlbGVjdGlvbigpLT50b05vcm1hbGl6ZWRS YW5nZSgpOwogICAgIGlmIChyYW5nZSkgewogICAgICAgICBzaXplX3QgbG9jYXRpb247CiAgICAg ICAgIHNpemVfdCBsZW5ndGg7Ci0gICAgICAgIGlmICghVGV4dEl0ZXJhdG9yOjpsb2NhdGlvbkFu ZExlbmd0aEZyb21SYW5nZShyYW5nZSwgbG9jYXRpb24sIGxlbmd0aCkpCisgICAgICAgIGlmICgh VGV4dEl0ZXJhdG9yOjpsb2NhdGlvbkFuZExlbmd0aEZyb21SYW5nZShyYW5nZS5nZXQoKSwgbG9j YXRpb24sIGxlbmd0aCkpCiAgICAgICAgICAgICByZXR1cm47CiAgICAgICAgIHNlbGVjdGlvblN0 YXRlLnNlbGVjdGVkUmFuZ2VTdGFydCA9IHN0YXRpY19jYXN0PHVpbnQ2NF90Pihsb2NhdGlvbik7 CiAgICAgICAgIHNlbGVjdGlvblN0YXRlLnNlbGVjdGVkUmFuZ2VMZW5ndGggPSBzdGF0aWNfY2Fz dDx1aW50NjRfdD4obGVuZ3RoKTsK