LibWeb: Abort ongoing navigation before firing next navigation event

I haven't found this being mentioned in the current spec, but that is
what chromium (atm the only other Navigation API implementer) does.

Fixes crashing when location.hash is changed subsequently more than once
using JS.
This commit is contained in:
Aliaksandr Kalenik 2024-04-16 18:29:07 +02:00 committed by Andreas Kling
commit 890da021c4
Notes: sideshowbarker 2024-07-17 02:59:43 +09:00
3 changed files with 16 additions and 0 deletions

View file

@ -0,0 +1,10 @@
<!DOCTYPE html>
<script src="../include.js"></script>
<script>
test(() => {
location.hash = "#1";
println(location.hash);
location.hash = "#2";
println(location.hash);
});
</script>

View file

@ -918,6 +918,10 @@ bool Navigation::inner_navigate_event_firing_algorithm(
Optional<String> download_request_filename,
Optional<SerializationRecord> classic_history_api_state)
{
// NOTE: Specification assumes that ongoing navigation event is cancelled before dispatching next navigation event.
if (m_ongoing_navigate_event)
abort_the_ongoing_navigation();
auto& realm = relevant_realm(*this);
// 1. If navigation has entries and events disabled, then: