Title: [104062] branches/safari-534.54-branch/Source/WebCore
Diff
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104061 => 104062)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 20:06:10 UTC (rev 104061)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 20:10:04 UTC (rev 104062)
@@ -1,5 +1,26 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 95497
+
+ 2011-09-19 Jeremy Apthorp <[email protected]>
+
+ Fix a use-after-free: clear the fullscreen change event target queue at
+ detach time, rather than at destruction time. If this isn't done, it's
+ possible for the event target queue to be the only thing that
+ references the document. Then when the document is popped off the queue
+ and dereferenced in Document::fullScreenChangeDelayTimerFired, the
+ document is destroyed and the subsequent access to
+ m_fullScreenChangeEventTargetQueue.isEmpty() accesses free'd memory.
+ https://bugs.webkit.org/show_bug.cgi?id=67960
+
+ Reviewed by Adam Barth.
+
+ * dom/Document.cpp:
+ (WebCore::Document::~Document):
+ (WebCore::Document::detach):
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95462
2011-09-19 Abhishek Arya <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/dom/Document.cpp (104061 => 104062)
--- branches/safari-534.54-branch/Source/WebCore/dom/Document.cpp 2012-01-04 20:06:10 UTC (rev 104061)
+++ branches/safari-534.54-branch/Source/WebCore/dom/Document.cpp 2012-01-04 20:10:04 UTC (rev 104062)
@@ -544,10 +544,6 @@
(*m_pageGroupUserSheets)[i]->clearOwnerNode();
}
-#if ENABLE(FULLSCREEN_API)
- m_fullScreenChangeEventTargetQueue.clear();
-#endif
-
deleteRetiredCustomFonts();
m_weakReference->clear();
@@ -1783,6 +1779,9 @@
clearAXObjectCache();
stopActiveDOMObjects();
m_eventQueue->cancelQueuedEvents();
+#if ENABLE(FULLSCREEN_API)
+ m_fullScreenChangeEventTargetQueue.clear();
+#endif
#if ENABLE(REQUEST_ANIMATION_FRAME)
// FIXME: consider using ActiveDOMObject.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
