ladybird/Tests/LibWeb/Crash/DOM
sideshowbarker 4af1b9357b LibWeb: Don't crash when evaluating XPath against a rootless document
Problem: Crash when evaluating an XPath expression against a document
that has no root element.

Cause: mirror_node()’s DOCUMENT_NODE branch unconditionally mirrored
document.document_element(). But a document may lack a root element —
in which case, document_element() returns null.

Fix: Return null from mirror_node() when the document has no root
element. (The caller already maps a null mirror result to a failed
evaluation, and raises an error in that case.)

Fixes https://github.com/LadybirdBrowser/ladybird/issues/10004
2026-06-23 08:59:01 +02:00
..
AbortSignal-any-crash.html
base-element-insert-crash.html LibWeb: Use document's global object in is_base_allowed_for_document 2025-08-16 14:19:05 +02:00
block-in-inline-removal-crash.html LibWeb: Clear paintables for continued layout nodes in removed_from 2026-06-14 19:39:15 +09:00
document-constructor-no-origin.html LibWeb/DOM: Set Document's origin in JS constructor 2025-06-18 08:49:01 +02:00
document-open-navigation-api.html LibWeb: Disable Navigation API after document.open() on about:blank 2026-03-29 16:39:03 +02:00
find-in-page-after-text-mutation.html LibWeb: Skip stale find-in-page text matches 2026-06-08 01:04:08 +02:00
find-in-page-after-textarea-string-insertion.html LibWeb: Skip stale find-in-page range endpoints 2026-06-08 01:04:08 +02:00
range-client-rects-at-container-end.html LibWeb: Handle Range rects starting after last child 2026-06-08 01:04:08 +02:00
scroll-into-view-without-scrolling-element.html LibWeb: Handle scrollIntoView without scrollingElement 2026-06-08 01:04:08 +02:00
selection-contains-node-shadow-host-removed.html LibWeb: Avoid a crash in Selection.containsNode() with a detached range 2026-05-22 16:39:25 +02:00
shadow-root-active-element.html LibWeb: Avoid crash when shadow root has null focused area 2025-10-12 22:50:12 +01:00
shadow-root-children-removed-on-attribute-change.html LibWeb: Run removed_from for descendants when shadow root removed 2026-06-14 19:39:15 +09:00
Window-find-code-units.html LibWeb: Use code unit offsets in Document::find_matching_text() 2025-06-13 15:08:26 +02:00
xhtml-namespace-change.xhtml LibWeb: Check parent node exists before checking its type 2025-07-15 18:37:50 +12:00
xpath-evaluate-rootless-document.html LibWeb: Don't crash when evaluating XPath against a rootless document 2026-06-23 08:59:01 +02:00