[webkit-reviews] review requested: [Bug 195683] REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key : [Attachment 364545] Patch

[bugzilla-daemon at webkit.org]

Antoine Quint <graouts at apple.com> has asked  for review:
Bug 195683: REGRESSION(r240634): Element::hasPointerCapture() passes a
JS-controlled value directly into a HashMap as a key
https://bugs.webkit.org/show_bug.cgi?id=195683

Attachment 364545: Patch

https://bugs.webkit.org/attachment.cgi?id=364545&action=review




--- Comment #2 from Antoine Quint <graouts at apple.com> ---
Created attachment 364545

  --> https://bugs.webkit.org/attachment.cgi?id=364545&action=review

Patch