Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
AX: Heap-use-after-free in WebCore::AXObjectCache::get(WebCore::Node*…
…)+0x41c rdar://113770369 Reviewed by Ryosuke Niwa. This UAF is most likely caused by a mutation in the WeakListHashSet while iterating over it. This patch avoids the problem by copying the set to a Vector and iterating over the Vector. The same technique is applied to another iteration over a WeakListHashsSet, m_deferredNodeAddedOrRemovedList, in the same method. * Source/WebCore/accessibility/AXObjectCache.cpp: (WebCore::AXObjectCache::performDeferredCacheUpdate): Originally-landed-as: 0f44690. rdar://117810598 Canonical link: https://commits.webkit.org/270478@main
- Loading branch information