commit bf5e404d002c3bc940847d95da577ad8e77bc5fe
author inferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sun Jan 06 18:53:15 2013 +0000
committer inferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sun Jan 06 18:53:15 2013 +0000
tree 7187d212679bec73f68fb0f12e9dac860830e4c2
parent 331e721f2ceae882432cbcb446becd0e386ec54c

Heap-use-after-free in WebCore::Document::implicitClose
https://bugs.webkit.org/show_bug.cgi?id=105655

Reviewed by Eric Seidel.

Source/WebCore:

Test: fast/dom/window-load-crash.html

* dom/Document.cpp:
(WebCore::Document::implicitClose): RefPtr protect |this| document since it
can be destroyed in the dispatchWindowLoadEvent call.

LayoutTests:

* fast/dom/window-load-crash-expected.txt: Added.
* fast/dom/window-load-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138918 268f45cc-cd09-0410-ab3c-d52691b4dbfc