From 4af1b9357b460d9a80c23ef8777b6dffd149d425 Mon Sep 17 00:00:00 2001 From: sideshowbarker Date: Sun, 21 Jun 2026 15:34:10 +0900 Subject: [PATCH] LibWeb: Don't crash when evaluating XPath against a rootless document MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Problem: Crash when evaluating an XPath expression against a document that has no root element. Cause: mirror_node()’s DOCUMENT_NODE branch unconditionally mirrored document.document_element(). But a document may lack a root element — in which case, document_element() returns null. Fix: Return null from mirror_node() when the document has no root element. (The caller already maps a null mirror result to a failed evaluation, and raises an error in that case.) Fixes https://github.com/LadybirdBrowser/ladybird/issues/10004 --- Libraries/LibWeb/XPath/XPath.cpp | 5 ++++- .../LibWeb/Crash/DOM/xpath-evaluate-rootless-document.html | 6 ++++++ 2 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 Tests/LibWeb/Crash/DOM/xpath-evaluate-rootless-document.html diff --git a/Libraries/LibWeb/XPath/XPath.cpp b/Libraries/LibWeb/XPath/XPath.cpp index a7b4ec67fe..96f38e24ac 100644 --- a/Libraries/LibWeb/XPath/XPath.cpp +++ b/Libraries/LibWeb/XPath/XPath.cpp @@ -92,7 +92,10 @@ static xmlNodePtr mirror_node(xmlDocPtr doc, DOM::Node const& node) } case DOM::NodeType::DOCUMENT_NODE: { auto const& document = static_cast(node); - return mirror_node(doc, *document.document_element()); + auto const* document_element = document.document_element(); + if (!document_element) + return nullptr; + return mirror_node(doc, *document_element); } case DOM::NodeType::DOCUMENT_TYPE_NODE: { return nullptr; // Unused in libxml2 diff --git a/Tests/LibWeb/Crash/DOM/xpath-evaluate-rootless-document.html b/Tests/LibWeb/Crash/DOM/xpath-evaluate-rootless-document.html new file mode 100644 index 0000000000..25ec545aa1 --- /dev/null +++ b/Tests/LibWeb/Crash/DOM/xpath-evaluate-rootless-document.html @@ -0,0 +1,6 @@ + +