diff --git a/Libraries/LibWeb/DOM/Element.cpp b/Libraries/LibWeb/DOM/Element.cpp index 0781009eabb..199db1e34c0 100644 --- a/Libraries/LibWeb/DOM/Element.cpp +++ b/Libraries/LibWeb/DOM/Element.cpp @@ -3153,6 +3153,10 @@ Element const* Element::list_owner() const // 2. Let ancestor be the element's parent. auto const* ancestor = parent_element(); + // AC-HOC: There may not be any parent element in a shadow tree. + if (!ancestor) + return nullptr; + // 3. If the element has an ol, ul, or menu ancestor, set ancestor to the closest such ancestor element. for_each_ancestor([&ancestor](GC::Ref node) { if (is(*node) || is(*node) || is(*node)) { @@ -3163,7 +3167,6 @@ Element const* Element::list_owner() const }); // 4. Return the closest inclusive ancestor of ancestor that produces a CSS box. - // Spec-Note: Such an element will always exist, as at the very least the document element will always produce a CSS box. ancestor->for_each_inclusive_ancestor([&ancestor](GC::Ref node) { if (is(*node) && node->paintable_box()) { ancestor = static_cast(node.ptr()); diff --git a/Tests/LibWeb/Crash/HTML/no-list-owner-custom-element.html b/Tests/LibWeb/Crash/HTML/no-list-owner-custom-element.html new file mode 100644 index 00000000000..b3d1f146b20 --- /dev/null +++ b/Tests/LibWeb/Crash/HTML/no-list-owner-custom-element.html @@ -0,0 +1,16 @@ + +