From 2afe208328f0b68e9f80b0c732355701a2b6d37a Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Wed, 28 May 2025 11:22:30 +0200 Subject: [PATCH] LibWeb: Iterate safely in process_top_layer_removals() We should not remove from a container while iterating over it, since that may disrupt iteration. --- Libraries/LibWeb/DOM/Document.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/Libraries/LibWeb/DOM/Document.cpp b/Libraries/LibWeb/DOM/Document.cpp index 37e82b77712..3b8379fc0a4 100644 --- a/Libraries/LibWeb/DOM/Document.cpp +++ b/Libraries/LibWeb/DOM/Document.cpp @@ -6122,13 +6122,18 @@ void Document::process_top_layer_removals() { // 1. For each element el in doc’s pending top layer removals: if el’s computed value of overlay is none, or el is // not rendered, remove el from doc’s top layer and pending top layer removals. + GC::RootVector> elements_to_remove(heap()); for (auto& element : m_top_layer_pending_removals) { // FIXME: Implement overlay property if (true || !element->paintable()) { - m_top_layer_elements.remove(element); - m_top_layer_pending_removals.remove(element); + elements_to_remove.append(element); } } + + for (auto& element : elements_to_remove) { + m_top_layer_elements.remove(element); + m_top_layer_pending_removals.remove(element); + } } // https://html.spec.whatwg.org/multipage/popover.html#topmost-auto-popover