eliott/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird synced 2026-04-27 18:17:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Handle null active document in content_document()

Browse Source 
The Crash/HTML/image-load-after-iframe-navigated.html test was
crashing on CI with a null pointer dereference at
NavigableContainer.cpp:178. The crash occurs because content_document()
dereferences the return value of active_document() without checking for
null.

When an iframe is navigated, Document::destroy() sets the old
document state's document to null via set_document(nullptr), but
the navigable (m_content_navigable) remains non-null since it is
reused for the new navigation. During the window between the old
document being destroyed and the new document being set,
active_document() returns null. If JS code accesses
iframe.contentDocument during this window (e.g. via a timer
callback), content_document() would dereference the null pointer.
This commit is contained in:
Aliaksandr Kalenik
2026-03-31 14:59:07 +02:00
committed by Alexander Kalenik
parent d7053a8eb8
commit 5a7ef7d494
Notes: github-actions[bot] 2026-03-31 16:33:08 +00:00 
Author: https://github.com/kalenikaliaksandr
Commit: https://github.com/LadybirdBrowser/ladybird/commit/5a7ef7d4944
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/8705
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Libraries/LibWeb/HTML/NavigableContainer.cpp
View File

@@ -174,11 +174,16 @@ DOM::Document const* NavigableContainer::content_document() const
// 2. Let document be container's content navigable's active document.
auto document = m_content_navigable->active_document();
// 4. If document's origin and container's node document's origin are not same origin-domain, then return null.
// AD-HOC: The active document can be null during navigation, after the old document
// has been destroyed but before the new document has been set.
if (!document)
return nullptr;
// 3. If document's origin and container's node document's origin are not same origin-domain, then return null.
if (!document->origin().is_same_origin_domain(m_document->origin()))
return nullptr;
// 5. Return document.
// 4. Return document.
return document;
}