/[blink]
Chromium logo

Revision 158727


Jump to revision: Previous Next
Author: yosin@chromium.org
Date: Wed Oct 2 15:30:12 2013 UTC (9 years, 7 months ago)
Changed paths: 1
Log Message:
Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()

This patch changes IndentOutdentCommand::tryIndentingAsListItem() to use RefPtr<T> instead of raw pointer for Node and Element not to remove during insertNodeBefore() and moveParagraphWIthClones() calls, which can execute user script to remove DOM nodes.

Note: When I tried to run a test case created by cluster fuzz, content_shell doesn't fail. It is hard to create a test case by hand.

BUG=294456
TEST=ClusterFuzz

Review URL: https://codereview.chromium.org/25691002

Changed paths

Path Details
Directorytrunk/Source/core/editing/IndentOutdentCommand.cpp modified , text changed

Properties

Name Value
commit-bot commit-bot@chromium.org

Powered by ViewVC 1.1.26 ViewVC Help