forked from mirrors/gecko-dev
8216d020bf
Automatic update from web-platform-tests [css-nesting] Fix a use-after-free on inserted parent selectors. When checking whether a selector list is nest containing, we temporarily set last_in_selector_list_ on the selector right before the (possibly) inserted &. However, when clearing it afterwards, we'd clear it on the wrong element (we didn't take into account that back() pointed to something else), leaving the flag there. This meant that Oilpan tracing would stop at the element, missing later complex selectors in the same list, eventually causing use-after-free. Only relevant when CSS Nesting is activated (which it isn't by default). Fixed: 1380313 Change-Id: Ia912ee2d5538d7067c0d14786158372a544d5cd3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3999320 Commit-Queue: Steinar H Gunderson <sesse@chromium.org> Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org> Cr-Commit-Position: refs/heads/main@{#1066437} -- wpt-commits: 09b793df81a0c847f3e0f3de8670cc8d96556e0b wpt-pr: 36779
16 lines
327 B
HTML
16 lines
327 B
HTML
<!DOCTYPE html>
|
|
<body>
|
|
<title>Use-after-free when inserting implicit parent selector</title>
|
|
<link rel="help" href="https://crbug.com/1380313">
|
|
<style>
|
|
:root {
|
|
:lang(en), :lang(en) {
|
|
}
|
|
}
|
|
</style>
|
|
<div lang="en"></div>
|
|
<script>
|
|
// Allocate a large chunk of memory, to trigger a GC.
|
|
new Int32Array(536870911);
|
|
</script>
|
|
|