Changeset 103967 in webkit

Timestamp:

Jan 3, 2012 1:57:43 PM (12 years ago)

Author:

inferno@chromium.org

Message:

Merge 102089 - Heap-buffer-overflow in WebCore::HTMLTreeBuilder::processEndTag
BUG=106316
Review URL: ​http://codereview.chromium.org/9072017

Location:

branches/chromium/963

Files:

• LayoutTests/fast/parser/foreign-content-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/parser/foreign-content-crash-expected.txt)
• LayoutTests/fast/parser/foreign-content-crash.html (copied) (copied from trunk/LayoutTests/fast/parser/foreign-content-crash.html)
• Source/WebCore/html/parser/HTMLTreeBuilder.cpp (modified) (1 diff)

branches/chromium/963/Source/WebCore/html/parser/HTMLTreeBuilder.cpp

@@ -2314 +2314 @@
         break;
     case InForeignContentMode:
-        if (m_tree.currentElement()->namespaceURI() == SVGNames::svgNamespaceURI)
+        if (m_tree.currentNode()->namespaceURI() == SVGNames::svgNamespaceURI)
             adjustSVGTagNameCase(token);