<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 4/17/2014 11:59, Jactry Zeng wrote:<br>
</div>
<blockquote
cite="mid:CAManwEzEyL_=aq9=QPL9NysNWUoxQLLd2vj2DnYMGHxfNLtcPQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra"><br>
2014-04-17 11:54 GMT+08:00 Nikolay Sivov <<a
moz-do-not-send="true" href="mailto:bunglehead@gmail.com">bunglehead@gmail.com</a>>:<br>
><br>
> What you're doing is a violation of refcount handling.
The rule is to release what you got, without relying on
internals like that. In this case GetSelection() returns
interface pointer and you're responsible in exactly one
Release() on it.<br>
><br>
> Interesting thing to test would be to check if
GetSelection() returns new instance every time it's called. If
this is a case it will justify some code changes to support
this, right now patch is wrong.<br>
><br>
> If it actually returns same interface pointer you can't
protect from use-after-free because I can grab multiple
references with several GetSelection() calls, and when I'll
try to release them it will be freed already by a loop like
that.<br>
<br>
Yes, you are right. GetSelection() will not return a new
pointer every time it's called, I have checked it by some
tests on Windows.</div>
</div>
</blockquote>
Did you actually change selection range in between of these calls?
It's possible that new instance will be returned after selection
changed. This way you'll end up with two alive instances.<br>
<br>
Another thing to test if ITextDocument responds to
IID_ITextSelection query.<br>
<blockquote
cite="mid:CAManwEzEyL_=aq9=QPL9NysNWUoxQLLd2vj2DnYMGHxfNLtcPQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">I will try some other ways to fix this
bug.<br>
</div>
</div>
</blockquote>
First thing to do is to figure out what relations are between these
interfaces.<br>
<blockquote
cite="mid:CAManwEzEyL_=aq9=QPL9NysNWUoxQLLd2vj2DnYMGHxfNLtcPQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra"><br>
Thanks again!<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div>Regards,<br>
</div>
<div>Jactry Zeng</div>
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>