[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-commits
Subject:    KDE/kdelibs/khtml/html
From:       Frerich Raabe <raabe () kde ! org>
Date:       2007-10-21 14:39:33
Message-ID: 1192977573.061726.23714.nullmailer () svn ! kde ! org
[Download RAW message or body]

SVN commit 727714 by raabe:

- Don't do 'Elem->next' when Elem has been delete'd previously. The problem is
  that popOneBlock() (on the very first loop iteration at least) possible
  deletes blockStart (at the end of the function). However, this is also what
  Elem is pointing to.

  Allen, can you verify that this is correct?
CCMAIL:kde@carewolf.com


 M  +2 -1      htmlparser.cpp  


--- trunk/KDE/kdelibs/khtml/html/htmlparser.cpp #727713:727714
@@ -1548,12 +1548,13 @@
     int level = tagPriority(_id);
     while( Elem && Elem->id != _id)
     {
+        HTMLStackElem *NextElem = Elem->next;
         if (endTagRequirement(Elem->id) == DOM::OPTIONAL && Elem->level <= level) {
             popOneBlock();
         }
         else
             break;
-        Elem = Elem->next;
+        Elem = NextElem;
     }
 }
 
[prev in list] [next in list] [prev in thread] [next in thread]