Use-after-free in WebCore::Range::compareBoundaryPoints

Source/core/page/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer. 
@@ skipping 436 matching lines @@
 bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
 {
     if (!m_frame)
         return false;
 
     FrameSelection* selection = m_frame->selection();
 
     if (!n || m_frame->document() != n->document() || selection->isNone())
         return false;
 
-    ContainerNode* parentNode = n->parentNode();
     unsigned nodeIndex = n->nodeIndex();
     RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
+    ContainerNode* parentNode = n->parentNode();
     if (!parentNode)
         return false;
 
     ExceptionCode ec = 0;
     bool nodeFullySelected = Range::compareBoundaryPoints(parentNode, nodeIndex, selectedRange->startContainer(), selectedRange->startOffset(), ec) >= 0 && !ec
         && Range::compareBoundaryPoints(parentNode, nodeIndex + 1, selectedRange->endContainer(), selectedRange->endOffset(), ec) <= 0 && !ec;
     ASSERT(!ec);
     if (nodeFullySelected)
         return true;
 
@@ skipping 59 matching lines @@
 
 bool DOMSelection::isValidForPosition(Node* node) const
 {
     ASSERT(m_frame);
     if (!node)
         return true;
     return node->document() == m_frame->document();
 }
 
 } // namespace WebCore