mirrors/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-04-20 11:36:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb/HTML: Handle no parent element for Element::list_owner

Browse source 
Fixes a crash when running Speedometer 3.0 as reduced in the included
test case.
This commit is contained in:
Shannon Booth 2025-04-18 17:07:41 +12:00
parent b88fddbf47
commit 41d8b8a1ec
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Libraries/LibWeb/DOM/Element.cpp
View file

@ -3153,6 +3153,10 @@ Element const* Element::list_owner() const
// 2. Let ancestor be the element's parent.
auto const* ancestor = parent_element();
// AC-HOC: There may not be any parent element in a shadow tree.
if (!ancestor)
return nullptr;
// 3. If the element has an ol, ul, or menu ancestor, set ancestor to the closest such ancestor element.
for_each_ancestor([&ancestor](GC::Ref<Node> node) {
if (is<HTML::HTMLOListElement>(*node) || is<HTML::HTMLUListElement>(*node) || is<HTML::HTMLMenuElement>(*node)) {
@ -3163,7 +3167,6 @@ Element const* Element::list_owner() const
});
// 4. Return the closest inclusive ancestor of ancestor that produces a CSS box.
// Spec-Note: Such an element will always exist, as at the very least the document element will always produce a CSS box.
ancestor->for_each_inclusive_ancestor([&ancestor](GC::Ref<Node> node) {
if (is<Element>(*node) && node->paintable_box()) {
ancestor = static_cast<Element const*>(node.ptr());

16
Tests/LibWeb/Crash/HTML/no-list-owner-custom-element.html Normal file
View file

@ -0,0 +1,16 @@
<todo-item></todo-item>
<script>
const template = document.createElement("template");
template.innerHTML = `<li></li>`;
class TodoItem extends HTMLElement {
constructor() {
super();
const shadow = this.attachShadow({ mode: "open" });
const node = document.importNode(template.content, true);
shadow.appendChild(node);
}
}
customElements.define("todo-item", TodoItem);
</script>