mirror of
https://github.com/LadybirdBrowser/ladybird
synced 2026-05-10 17:12:41 +02:00
5da72570b8
These handlers crashed on several kinds of JS-dispatched input: zero-width range (divide by zero in the slider mouse handler), step="any" (MUST(step_up) throws InvalidStateError), plain Event without clientX/deltaY/key (unchecked as_foo() asserts on undefined), min > max (trips clamp()'s VERIFY), and input.type changes leaving the range listeners attached to dereference empty Optionals from the range-only min()/max() accessors. Gate each handler on its expected type_state() and on allowed_value_step() having a value, validate event property types before converting, and bail out on zero-width rects or min > max. Six crash tests cover the new paths. Hit on a Cloudflare challenge page.
9 lines
252 B
HTML
9 lines
252 B
HTML
<!DOCTYPE html>
|
|
<input type="range" id="r">
|
|
<script>
|
|
const input = document.getElementById("r");
|
|
input.dispatchEvent(new Event("mousedown"));
|
|
input.dispatchEvent(new Event("wheel"));
|
|
input.dispatchEvent(new Event("keydown"));
|
|
</script>
|