Use-after-free in WebCore::Range::compareBoundaryPoints

Source/core/page/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer. 
@@ skipping 426 matching lines @@
 
     RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
     if (!selectedRange)
         return;
 
     selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
 
     setBaseAndExtent(selectedRange->startContainer(ASSERT_NO_EXCEPTION), selectedRange->startOffset(), selectedRange->startContainer(), selectedRange->startOffset(), ASSERT_NO_EXCEPTION);
 }
 
-bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
+bool DOMSelection::containsNode(Node* n, bool allowPartial) const
 {
     if (!m_frame)
         return false;
 
+    // toNormalizedRange can trigger layout, which can remove the last
+    // reference to node |n|,

[ojan, 2013/05/20 02:30:48]

The render tree doesn't hold refptrs to Nodes AFAIK, how does a layout remove
the last reference?

Looking at the test case in this patch, it seems like the problem is that
javascript isn't keeping the Node alive. If it's really layout that is removing
the last reference to the node, you should be able to get a use-after-free by
doing something like the following after the document.close() call:
document.documentElement.offsetHeight;
element.parentNode;

+    RefPtr<Node> protect(n);
+
     FrameSelection* selection = m_frame->selection();
 
     if (!n || m_frame->document() != n->document() || selection->isNone())
         return false;
 
-    ContainerNode* parentNode = n->parentNode();
     unsigned nodeIndex = n->nodeIndex();
     RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
+    ContainerNode* parentNode = n->parentNode();
     if (!parentNode)
         return false;
 
     ExceptionCode ec = 0;
     bool nodeFullySelected = Range::compareBoundaryPoints(parentNode, nodeIndex, selectedRange->startContainer(), selectedRange->startOffset(), ec) >= 0 && !ec
         && Range::compareBoundaryPoints(parentNode, nodeIndex + 1, selectedRange->endContainer(), selectedRange->endOffset(), ec) <= 0 && !ec;
     ASSERT(!ec);
     if (nodeFullySelected)
         return true;
 
@@ skipping 59 matching lines @@
 
 bool DOMSelection::isValidForPosition(Node* node) const
 {
     ASSERT(m_frame);
     if (!node)
         return true;
     return node->document() == m_frame->document();
 }
 
 } // namespace WebCore