dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibWeb: Handle null active document in content_document()

Browse source 
The Crash/HTML/image-load-after-iframe-navigated.html test was
crashing on CI with a null pointer dereference at
NavigableContainer.cpp:178. The crash occurs because content_document()
dereferences the return value of active_document() without checking for
null.

When an iframe is navigated, Document::destroy() sets the old
document state's document to null via set_document(nullptr), but
the navigable (m_content_navigable) remains non-null since it is
reused for the new navigation. During the window between the old
document being destroyed and the new document being set,
active_document() returns null. If JS code accesses
iframe.contentDocument during this window (e.g. via a timer
callback), content_document() would dereference the null pointer.
This commit is contained in:
Aliaksandr Kalenik 2026-03-31 14:59:07 +02:00 committed by Alexander Kalenik
parent d7053a8eb8
commit 5a7ef7d494
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
Libraries/LibWeb/HTML/NavigableContainer.cpp
View file

@ -174,11 +174,16 @@ DOM::Document const* NavigableContainer::content_document() const
// 2. Let document be container's content navigable's active document.
auto document = m_content_navigable->active_document();
// 4. If document's origin and container's node document's origin are not same origin-domain, then return null.
// AD-HOC: The active document can be null during navigation, after the old document
// has been destroyed but before the new document has been set.
if (!document)
return nullptr;
// 3. If document's origin and container's node document's origin are not same origin-domain, then return null.
if (!document->origin().is_same_origin_domain(m_document->origin()))
return nullptr;
// 5. Return document.
// 4. Return document.
return document;
}