Andreas Kling 354a20217c LibWeb: Handle null active document in destroy_the_child_navigable ...

When an ancestor document is unloaded, its child documents are unloaded
(and destroyed) first, which leaves their navigable's active document
null. If the ancestor's pagehide handler then removes a subtree
containing one of those iframe containers, destroy_the_child_navigable
crashed dereferencing the null active document.

Treat the "destroy a document and its descendants" step as a no-op when
there is no document left to destroy, and still run the remaining
post-destruction cleanup.

This fixes a crash when closing a GMail tab.

2026-04-16 12:38:38 +02:00

19 KiB

Raw Blame History

View Raw