mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-01 21:59:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Correct logic for removing end nodes from HTMLOptionsCollection

Browse source 
This test case would previously crash.

Found with domato.
This commit is contained in:
Sam Atkins 2024-07-27 13:33:51 +01:00 • committed by Tim Ledbetter
commit 0cec68ea99
Notes: github-actions[bot] 2024-07-27 19:24:14 +00:00
3 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Tests/LibWeb/Text/expected/DOM/HTMLSelectElement-length.txt Normal file
View file

@ -0,0 +1,3 @@
0
1
0

12
Tests/LibWeb/Text/input/DOM/HTMLSelectElement-length.html Normal file
View file

@ -0,0 +1,12 @@
<script src="../include.js"></script>
<script>
test(() => {
const select = document.createElement("select");
const option = document.createElement("option");
println(select.length);
select.add(option);
println(select.length);
select.length = 0;
println(select.length);
});
</script>

4
Userland/Libraries/LibWeb/HTML/HTMLOptionsCollection.cpp
View file

@ -66,8 +66,8 @@ WebIDL::ExceptionOr<void> HTMLOptionsCollection::set_length(WebIDL::UnsignedLong
auto n = current - value; auto n = current - value;
// 3.2. Remove the last n nodes in the collection from their parent nodes. // 3.2. Remove the last n nodes in the collection from their parent nodes.
for (WebIDL::UnsignedLong i = current - 1; i >= current - n; i--) for (auto i = 0u; i < n; i++)
this->item(i)->remove(); item(length() - 1)->remove();
} }
return {}; return {};