eliott/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird synced 2026-04-30 19:47:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Empty CE reaction queue instead of destroying it on exception

Browse Source 
If an exception occurs in a custom element constructor, we clear the
reaction queue by destroying it, instead of emptying the Vector.
3da6916383/Userland/Libraries/LibWeb/DOM/Element.cpp (L2033)

This causes a UAF here, as async upgrades (i.e. custom elements not
created by document.createElement) are performed in this loop:
3da6916383/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp (L657)

Fixes crash when loading https://github.com/SerenityOS/serenity
This commit is contained in:
Luke Wilde
2024-03-01 00:58:51 +00:00
committed by Tim Flynn
parent 5b4533cab8
commit 48e11a1f12
Notes: sideshowbarker 2024-07-17 05:18:58 +09:00 
Author: https://github.com/Lubrsi
Commit: https://github.com/SerenityOS/serenity/commit/48e11a1f12
Pull-request: https://github.com/SerenityOS/serenity/pull/23409
3 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
Tests/LibWeb/Text/input/HTML/custom-elements-throw-in-constructor.html Normal file
View File

@@ -0,0 +1,20 @@
<test-element></test-element>
<script src="../include.js"></script>
<script>
test(() => {
class TestElement extends HTMLElement {
constructor() {
super();
println("Entered TestElement constructor, throwing.");
throw "test";
}
connectedCallback() {
println("connectedCallback");
}
}
customElements.define("test-element", TestElement);
println("PASS! (Didn't crash)");
});
</script>