|Summary:||REGRESSION (r83081): Use of deallocated memory in WebEditorClient::respondToChangedSelection()|
|Product:||WebKit||Reporter:||Alexey Proskuryakov <ap>|
|Component:||WebKit Misc.||Assignee:||Alexey Proskuryakov <ap>|
|Version:||528+ (Nightly build)|
|OS:||OS X 10.6|
Description Alexey Proskuryakov 2011-04-07 14:36:27 PDT
There is nothing protecting the range object. This used to not be a problem before this patch because temporary objects in C++ are deleted after the full expression is evaluated, so it wasn't destroyed until after the function call. Patch forthcoming.
Comment 1 Alexey Proskuryakov 2011-04-07 14:39:09 PDT
Created attachment 88702 [details] proposed fix
Comment 2 Brian Weinstein 2011-04-07 14:41:37 PDT
Comment on attachment 88702 [details] proposed fix View in context: https://bugs.webkit.org/attachment.cgi?id=88702&action=review > Source/WebKit2/ChangeLog:9 > + Now that the Range is used outide the full expression where it's created, it needs to be Typo: outside.