dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibWeb: Handle child navigables without active documents

Browse source 
A queued document unload can capture child navigables whose active
document is gone by the time the task runs. In that state there is no
child document to unload, but the parent's lifecycle counter still needs
to advance.

Run the unload completion step directly when a child navigable has no
active document. Add coverage for removing an iframe during a child
navigation.
This commit is contained in:
Andreas Kling 2026-06-06 15:21:58 +02:00 committed by Andreas Kling
parent 4d868d7d82
commit b42cf66a9a
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Libraries/LibWeb/DOM/Document.cpp
View file

@ -5744,7 +5744,10 @@ void Document::unload_a_document_and_its_descendants(GC::Ptr<Document> new_docum
auto increment_unloaded = GC::create_function(heap, [unload_state] { unload_state->did_process_child(); });
// 2. Unload a document and its descendants given childNavigable's active document, null, and incrementUnloaded.
child_navigable->active_document()->unload_a_document_and_its_descendants({}, increment_unloaded);
if (auto active_document = child_navigable->active_document())
active_document->unload_a_document_and_its_descendants({}, increment_unloaded);
else
increment_unloaded->function()();
}));
}

6
Tests/LibWeb/Crash/HTML/removed-iframe-during-child-navigation.html Normal file
View file

@ -0,0 +1,6 @@
<!DOCTYPE html>
<iframe id="frame" srcdoc="PASS"></iframe>
<script>
frame.src = "data:text/html,child";
setTimeout(() => frame.remove(), 0);
</script>