Use-after-free in WebCore::Range::compareBoundaryPoints

Source/core/page/DOMSelection.cpp

Index: Source/core/page/DOMSelection.cpp
diff --git a/Source/core/page/DOMSelection.cpp b/Source/core/page/DOMSelection.cpp
index ed91368b54e33510b8c38708c047c5e0a8308bde..bd0dad831a7364680147adc7dabb7871a0a6e119 100644
--- a/Source/core/page/DOMSelection.cpp
+++ b/Source/core/page/DOMSelection.cpp
@@ -444,20 +444,24 @@ void DOMSelection::deleteFromDocument()
     setBaseAndExtent(selectedRange->startContainer(ASSERT_NO_EXCEPTION), selectedRange->startOffset(), selectedRange->startContainer(), selectedRange->startOffset(), ASSERT_NO_EXCEPTION);
 }
 
-bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
+bool DOMSelection::containsNode(Node* n, bool allowPartial) const
 {
     if (!m_frame)
         return false;
 
+    // toNormalizedRange can trigger layout, which can remove the last
+    // reference to node |n|,

[ojan, 2013/05/20 02:30:48]

The render tree doesn't hold refptrs to Nodes AFAIK, how does a layout remove
the last reference?

Looking at the test case in this patch, it seems like the problem is that
javascript isn't keeping the Node alive. If it's really layout that is removing
the last reference to the node, you should be able to get a use-after-free by
doing something like the following after the document.close() call:
document.documentElement.offsetHeight;
element.parentNode;

+    RefPtr<Node> protect(n);
+
     FrameSelection* selection = m_frame->selection();
 
     if (!n || m_frame->document() != n->document() || selection->isNone())
         return false;
 
-    ContainerNode* parentNode = n->parentNode();
     unsigned nodeIndex = n->nodeIndex();
     RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
+    ContainerNode* parentNode = n->parentNode();
     if (!parentNode)
         return false;