 Chromium Code Reviews
 Chromium Code Reviews Issue 9250021:
  Merge 105120 - Heap-use-after-free in WebCore::RenderBlock::selectionGaps  (Closed) 
  Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/912/
    
  
    Issue 9250021:
  Merge 105120 - Heap-use-after-free in WebCore::RenderBlock::selectionGaps  (Closed) 
  Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/912/| Index: Source/WebCore/rendering/RenderBox.cpp | 
| =================================================================== | 
| --- Source/WebCore/rendering/RenderBox.cpp (revision 105342) | 
| +++ Source/WebCore/rendering/RenderBox.cpp (working copy) | 
| @@ -289,6 +289,7 @@ | 
| if (parent && parent->isDeprecatedFlexibleBox()) | 
| parentBlock = toRenderBlock(parent); | 
| + parentBlock->markSiblingsWithFloatsForLayout(this); | 
| parentBlock->markAllDescendantsWithFloatsForLayout(this, false); | 
| } | 
| } |