Andrey Mnatsakanov 52e110b67c fix(dom): guard DomTree::remove() against OOB and double-free ...

remove() freed a node and its descendants by directly indexing inner.nodes and
unconditionally pushing each slot onto the free list. An out-of-range id panicked
out-of-bounds, and removing an already-freed node pushed its slot a second time,
so two later allocations could be handed the same NodeId (aliasing/corruption).
Free a slot only when it is currently live, via checked access.

Fixes #500

2026-07-26 13:29:12 +02:00

..

src

fix(dom): guard DomTree::remove() against OOB and double-free

2026-07-26 13:29:12 +02:00

Cargo.toml

Initial Release

2026-04-13 12:30:28 +02:00