ladybird/Tests/LibWeb/Text/input/HTML/DataTransfer-clearData-stale-item.html
Tim Ledbetter 525ce459fc LibWeb: Avoid stale DataTransferItem access after clearing data
Previously, clearing a DataTransfer's data removed entries from the
drag data store without updating the associated `DataTransferItem`
objects. An item obtained beforehand kept an index that no longer
referenced a valid entry, so reading its kind or type accessed an
out of bounds element of the now-empty list and crashed. We now keep
the item objects in sync when clearing data, placing any stale ones
into the disabled mode.
2026-06-08 13:40:22 +02:00

19 lines
772 B
HTML

<!DOCTYPE html>
<script src="../include.js"></script>
<script>
test(() => {
const dataTransfer = new DataTransfer();
const item = dataTransfer.items.add("payload", "text/plain");
dataTransfer.clearData();
println(`items.length after clearData = ${dataTransfer.items.length}`);
// The item is now in the disabled mode, because it is not associated with a drag data store.
// DataTransferItem's kind and type should be empty string because we are in disabled mode, but other engines
// don't seem to follow the spec here.
println(`stale item kind = "${item.kind}"`);
println(`stale item type = "${item.type}"`);
println(`stale item getAsFile() = ${item.getAsFile()}`);
});
</script>