Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(482)

Unified Diff: third_party/WebKit/Source/core/html/HTMLMenuItemElement.cpp

Issue 1962073003: Fix ASan container overflow in HTMLMenuItemElement::defaultEventHandler (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Adding tests Created 4 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « third_party/WebKit/LayoutTests/fast/dom/HTMLMenuItemElement/menuitem-crash-asan-expected.txt ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: third_party/WebKit/Source/core/html/HTMLMenuItemElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLMenuItemElement.cpp b/third_party/WebKit/Source/core/html/HTMLMenuItemElement.cpp
index e397cda6c7e2fd4fa211f5fcf35da5ec8e17c111..eb25dbe661401c079a5cfd28aa7363e86c4f8b7c 100644
--- a/third_party/WebKit/Source/core/html/HTMLMenuItemElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLMenuItemElement.cpp
@@ -29,7 +29,7 @@ void HTMLMenuItemElement::defaultEventHandler(Event* event)
setAttribute(checkedAttr, "checked");
} else if (equalIgnoringCase(fastGetAttribute(typeAttr), "radio")) {
if (Element* parent = parentElement()) {
- const AtomicString& group = fastGetAttribute(radiogroupAttr);
+ AtomicString group = fastGetAttribute(radiogroupAttr);
for (HTMLMenuItemElement& menuItem : Traversal<HTMLMenuItemElement>::childrenOf(*parent)) {
if (!menuItem.fastHasAttribute(checkedAttr))
continue;
« no previous file with comments | « third_party/WebKit/LayoutTests/fast/dom/HTMLMenuItemElement/menuitem-crash-asan-expected.txt ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698