[webkit-reviews] review granted: [Bug 132337] REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox : [Attachment 230382] Patch

[bugzilla-daemon at webkit.org]

Simon Fraser (smfr) <simon.fraser at apple.com> has granted Manuel Rego Casasnovas
<rego at igalia.com>'s request for review:
Bug 132337: REGRESSION (r167879): Heap-use-after-free in
WebCore::RenderFlexibleBox
https://bugs.webkit.org/show_bug.cgi?id=132337

Attachment 230382: Patch
https://bugs.webkit.org/attachment.cgi?id=230382&action=review

------- Additional Comments from Simon Fraser (smfr) <simon.fraser at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=230382&action=review


> Source/WebCore/ChangeLog:15
> +	   The solution is simple: just clear the memory when we remove a
child.

"clear the memory" doesn't really match removing all items from the m_children
vector.