[webkit-reviews] review granted: [Bug 132337] REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox : [Attachment 230382] Patch
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Apr 29 09:55:52 PDT 2014
Simon Fraser (smfr) <simon.fraser at apple.com> has granted Manuel Rego Casasnovas
<rego at igalia.com>'s request for review:
Bug 132337: REGRESSION (r167879): Heap-use-after-free in
WebCore::RenderFlexibleBox
https://bugs.webkit.org/show_bug.cgi?id=132337
Attachment 230382: Patch
https://bugs.webkit.org/attachment.cgi?id=230382&action=review
------- Additional Comments from Simon Fraser (smfr) <simon.fraser at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=230382&action=review
> Source/WebCore/ChangeLog:15
> + The solution is simple: just clear the memory when we remove a
child.
"clear the memory" doesn't really match removing all items from the m_children
vector.
More information about the webkit-reviews
mailing list