5da72570b8
These handlers crashed on several kinds of JS-dispatched input: zero-width range (divide by zero in the slider mouse handler), step="any" (MUST(step_up) throws InvalidStateError), plain Event without clientX/deltaY/key (unchecked as_foo() asserts on undefined), min > max (trips clamp()'s VERIFY), and input.type changes leaving the range listeners attached to dereference empty Optionals from the range-only min()/max() accessors. Gate each handler on its expected type_state() and on allowed_value_step() having a value, validate event property types before converting, and bail out on zero-width rects or min > max. Six crash tests cover the new paths. Hit on a Cloudflare challenge page.
5 lines
174 B
HTML
5 lines
174 B
HTML
<!DOCTYPE html>
|
|
<input type="range" step="any" id="r">
|
|
<script>
|
|
document.getElementById("r").dispatchEvent(new KeyboardEvent("keydown", { key: "ArrowLeft" }));
|
|
</script>
|