Files
ladybird/Libraries/LibWeb/HTML
Aliaksandr Kalenik 5a7ef7d494 LibWeb: Handle null active document in content_document()
The Crash/HTML/image-load-after-iframe-navigated.html test was
crashing on CI with a null pointer dereference at
NavigableContainer.cpp:178. The crash occurs because content_document()
dereferences the return value of active_document() without checking for
null.

When an iframe is navigated, Document::destroy() sets the old
document state's document to null via set_document(nullptr), but
the navigable (m_content_navigable) remains non-null since it is
reused for the new navigation. During the window between the old
document being destroyed and the new document being set,
active_document() returns null. If JS code accesses
iframe.contentDocument during this window (e.g. via a timer
callback), content_document() would dereference the null pointer.
2026-03-31 18:31:53 +02:00
..
2025-08-23 16:04:36 -06:00
2026-01-11 00:01:24 +01:00
2026-01-11 00:01:24 +01:00
2024-11-25 21:13:53 +01:00
2026-02-18 08:02:45 -05:00
2026-02-18 08:02:45 -05:00
2026-02-11 16:32:20 +00:00
2026-02-11 16:32:20 +00:00
2025-08-08 10:23:17 +02:00