mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-05-22 02:52:52 +00:00
48e11a1f12
If an exception occurs in a custom element constructor, we clear the reaction queue by destroying it, instead of emptying the Vector.3da6916383/Userland/Libraries/LibWeb/DOM/Element.cpp (L2033)This causes a UAF here, as async upgrades (i.e. custom elements not created by document.createElement) are performed in this loop:3da6916383/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp (L657)Fixes crash when loading https://github.com/SerenityOS/serenity
20 lines
535 B
HTML
20 lines
535 B
HTML
<test-element></test-element>
|
|
<script src="../include.js"></script>
|
|
<script>
|
|
test(() => {
|
|
class TestElement extends HTMLElement {
|
|
constructor() {
|
|
super();
|
|
println("Entered TestElement constructor, throwing.");
|
|
throw "test";
|
|
}
|
|
|
|
connectedCallback() {
|
|
println("connectedCallback");
|
|
}
|
|
}
|
|
|
|
customElements.define("test-element", TestElement);
|
|
println("PASS! (Didn't crash)");
|
|
});
|
|
</script>
|