mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-11 18:50:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb: Don't crash when updating a select with detached option elements

Browse source 
`Node::shadow_including_root()` was missing a null check, which caused
a crash when manipulating a select element, whose option elements were
initially detached.
This commit is contained in:
Tim Ledbetter 2024-03-23 15:46:08 +00:00 • committed by Andreas Kling
commit 2227674b91
Notes: sideshowbarker 2024-07-17 08:55:54 +09:00
3 changed files with 18 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/HTML/HTMLSelectElement-with-detached-option.txt Normal file
View file

@ -0,0 +1 @@
PASS (didn't crash)

13
Tests/LibWeb/Text/input/HTML/HTMLSelectElement-with-detached-option.html Normal file
View file

@ -0,0 +1,13 @@
<!DOCTYPE html>
<script src="../include.js"></script>
<select></select>
<script>
test(() => {
const selectElement = document.querySelector("select");
const optionElement = document.createElement("option");
optionElement.innerHTML = "option text"
selectElement.appendChild(optionElement);
document.body.removeChild(selectElement);
println("PASS (didn't crash)");
});
</script>

6
Userland/Libraries/LibWeb/DOM/Node.cpp
View file

@ -320,8 +320,10 @@ Node& Node::shadow_including_root()
// The shadow-including root of an object is its root’s host’s shadow-including root,
// if the object’s root is a shadow root; otherwise its root.
auto& node_root = root();
if (is<ShadowRoot>(node_root))
return static_cast<ShadowRoot&>(node_root).host()->shadow_including_root();
if (is<ShadowRoot>(node_root)) {
if (auto* host = static_cast<ShadowRoot&>(node_root).host(); host)
return host->shadow_including_root();
}
return node_root;
}