dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibWeb: Handle BarProp without a top-level context

Browse source 
BarProp.visible first handles a null browsing context, but the
top-level browsing context lookup can also return null when the
relevant document is no longer fully active. Return true in that
case instead of dereferencing the null result.

Add a reduced Crash/HTML test from the domato fuzz-00063 sanitizer
finding that reads menubar.visible through an inactive frame window.
This commit is contained in:
Andreas Kling 2026-06-06 21:32:28 +02:00 committed by Andreas Kling
parent 8f1dd07ae0
commit 7afc862bc0
2 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Libraries/LibWeb/HTML/BarProp.cpp
View file

@ -38,7 +38,10 @@ bool BarProp::visible() const
}
// 3. Return the negation of browsingContext's top-level browsing context's is popup.
return browsing_context->top_level_browsing_context()->is_popup() != TokenizedFeature::Popup::Yes;
auto top_level_browsing_context = browsing_context->top_level_browsing_context();
if (!top_level_browsing_context)
return true;
return top_level_browsing_context->is_popup() != TokenizedFeature::Popup::Yes;
}
void BarProp::initialize(JS::Realm& realm)

13
Tests/LibWeb/Crash/HTML/barprop-visible-in-inactive-frame.html Normal file
View file

@ -0,0 +1,13 @@
<!DOCTYPE html>
<script>
const outer = document.createElement("iframe");
document.body.appendChild(outer);
const inner = outer.contentDocument.createElement("iframe");
outer.contentDocument.body.appendChild(inner);
const innerWindow = inner.contentWindow;
outer.remove();
innerWindow.menubar.visible;
</script>