Bug 58082 - REGRESSION (r83081): Use of deallocated memory in WebEditorClient::respondToChangedSelection()
Summary: REGRESSION (r83081): Use of deallocated memory in WebEditorClient::respondToC...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh OS X 10.6
: P1 Normal
Assignee: Alexey Proskuryakov
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-04-07 14:36 PDT by Alexey Proskuryakov
Modified: 2011-04-07 14:43 PDT (History)
1 user (show)

See Also:


Attachments
proposed fix (1.80 KB, patch)
2011-04-07 14:39 PDT, Alexey Proskuryakov
bweinstein: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2011-04-07 14:36:27 PDT
There is nothing protecting the range object.

This used to not be a problem before this patch because temporary objects in C++ are deleted after the full expression is evaluated, so it wasn't destroyed until after the function call.

Patch forthcoming.
Comment 1 Alexey Proskuryakov 2011-04-07 14:39:09 PDT
Created attachment 88702 [details]
proposed fix
Comment 2 Brian Weinstein 2011-04-07 14:41:37 PDT
Comment on attachment 88702 [details]
proposed fix

View in context: https://bugs.webkit.org/attachment.cgi?id=88702&action=review

> Source/WebKit2/ChangeLog:9
> +        Now that the Range is used outide the full expression where it's created, it needs to be

Typo: outside.
Comment 3 Alexey Proskuryakov 2011-04-07 14:43:21 PDT
Committed <http://trac.webkit.org/changeset/83211>.