[Webkit-unassigned] [Bug 195683] REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Mar 13 10:29:56 PDT 2019


Antoine Quint <graouts at apple.com> changed:

           What    |Removed                     |Added
           Assignee|webkit-unassigned at lists.web |graouts at apple.com
                   |kit.org                     |

You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190313/e0059946/attachment-0001.html>

More information about the webkit-unassigned mailing list