commit 23cb427ade6192348aab9d48d16f57829d0b5a1c
author akling@apple.com <akling@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Dec 11 20:46:56 2012 +0000
committer akling@apple.com <akling@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Dec 11 20:46:56 2012 +0000
tree b7e3c02166e0a79e5a9cfa4cc463f2c11eee08af
parent 68b135d7b3cebd212e6d9fa88593e8e98edc40fc

REGRESSION(r133492): Heap-use-after-free in WebCore::Element::normalizeAttributes
<http://webkit.org/b/104488>

Reviewed by Antti Koivisto.

Source/WebCore:

Don't cache the AttrNodeList* in a local when iterating over an Element's Attr nodes since
that pointer may go stale if JS runs in response to a DOMSubtreeModified event below Node::normalize().

Test: fast/dom/normalize-attributes-mutation-event-crash.html

* dom/Element.cpp:
(WebCore::Element::normalizeAttributes):

LayoutTests:

* fast/dom/normalize-attributes-mutation-event-crash-expected.txt: Added.
* fast/dom/normalize-attributes-mutation-event-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@137341 268f45cc-cd09-0410-ab3c-d52691b4dbfc