From 46c15276e953d724be5c8a1bf8cab69b2c7ba1d8 Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Fri, 23 Oct 2020 08:31:26 +0200
Subject: [PATCH] LibWeb: Fix Document construction mishap in <template>
 element

Ref-counted objects must not be stack allocated. Make DOM::Document's
constructor private to avoid this issue. (I wish we could mark classes
as heap-only..)
---
 Applications/Browser/ConsoleWidget.cpp              | 2 +-
 Applications/IRCClient/IRCLogBuffer.cpp             | 2 +-
 Libraries/LibWeb/DOM/Document.h                     | 4 +++-
 Libraries/LibWeb/HTML/HTMLTemplateElement.cpp       | 4 ++--
 Libraries/LibWeb/HTML/Parser/HTMLDocumentParser.cpp | 2 +-
 Libraries/LibWeb/Loader/FrameLoader.cpp             | 4 ++--
 Userland/test-web.cpp                               | 2 +-
 7 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/Applications/Browser/ConsoleWidget.cpp b/Applications/Browser/ConsoleWidget.cpp
index f6a843ddbb..8de5adb6b4 100644
--- a/Applications/Browser/ConsoleWidget.cpp
+++ b/Applications/Browser/ConsoleWidget.cpp
@@ -47,7 +47,7 @@ ConsoleWidget::ConsoleWidget()
     set_layout<GUI::VerticalBoxLayout>();
     set_fill_with_background_color(true);
 
-    auto base_document = adopt(*new Web::DOM::Document);
+    auto base_document = Web::DOM::Document::create();
     base_document->append_child(adopt(*new Web::DOM::DocumentType(base_document)));
     auto html_element = base_document->create_element("html");
     base_document->append_child(html_element);
diff --git a/Applications/IRCClient/IRCLogBuffer.cpp b/Applications/IRCClient/IRCLogBuffer.cpp
index 92a952d61b..b292e0a4ee 100644
--- a/Applications/IRCClient/IRCLogBuffer.cpp
+++ b/Applications/IRCClient/IRCLogBuffer.cpp
@@ -40,7 +40,7 @@ NonnullRefPtr<IRCLogBuffer> IRCLogBuffer::create()
 
 IRCLogBuffer::IRCLogBuffer()
 {
-    m_document = adopt(*new Web::DOM::Document);
+    m_document = Web::DOM::Document::create();
     m_document->append_child(adopt(*new Web::DOM::DocumentType(document())));
     auto html_element = m_document->create_element("html");
     m_document->append_child(html_element);
diff --git a/Libraries/LibWeb/DOM/Document.h b/Libraries/LibWeb/DOM/Document.h
index b4fb5d073d..b179254867 100644
--- a/Libraries/LibWeb/DOM/Document.h
+++ b/Libraries/LibWeb/DOM/Document.h
@@ -57,7 +57,7 @@ class Document
 public:
     using WrapperType = Bindings::DocumentWrapper;
 
-    explicit Document(const URL& = {});
+    static NonnullRefPtr<Document> create(const URL& url = {}) { return adopt(*new Document(url)); }
     virtual ~Document() override;
 
     void set_url(const URL& url) { m_url = url; }
@@ -192,6 +192,8 @@ public:
     Window& window() { return *m_window; }
 
 private:
+    explicit Document(const URL&);
+
     virtual RefPtr<LayoutNode> create_layout_node(const CSS::StyleProperties* parent_style) override;
 
     void tear_down_layout_tree();
diff --git a/Libraries/LibWeb/HTML/HTMLTemplateElement.cpp b/Libraries/LibWeb/HTML/HTMLTemplateElement.cpp
index ee166924b1..8a0209337b 100644
--- a/Libraries/LibWeb/HTML/HTMLTemplateElement.cpp
+++ b/Libraries/LibWeb/HTML/HTMLTemplateElement.cpp
@@ -44,8 +44,8 @@ DOM::Document& HTMLTemplateElement::appropriate_template_contents_owner_document
 {
     if (!document.created_for_appropriate_template_contents()) {
         if (!document.associated_inert_template_document()) {
-            DOM::Document new_document;
-            new_document.set_created_for_appropriate_template_contents(true);
+            auto new_document = DOM::Document::create();
+            new_document->set_created_for_appropriate_template_contents(true);
 
             // FIXME: If doc is an HTML document, mark new doc as an HTML document also.
 
diff --git a/Libraries/LibWeb/HTML/Parser/HTMLDocumentParser.cpp b/Libraries/LibWeb/HTML/Parser/HTMLDocumentParser.cpp
index 26a3598539..6872bf1546 100644
--- a/Libraries/LibWeb/HTML/Parser/HTMLDocumentParser.cpp
+++ b/Libraries/LibWeb/HTML/Parser/HTMLDocumentParser.cpp
@@ -118,7 +118,7 @@ RefPtr<DOM::Document> parse_html_document(const StringView& data, const URL& url
 HTMLDocumentParser::HTMLDocumentParser(const StringView& input, const String& encoding)
     : m_tokenizer(input, encoding)
 {
-    m_document = adopt(*new DOM::Document);
+    m_document = DOM::Document::create();
 }
 
 HTMLDocumentParser::HTMLDocumentParser(const StringView& input, const String& encoding, DOM::Document& existing_document)
diff --git a/Libraries/LibWeb/Loader/FrameLoader.cpp b/Libraries/LibWeb/Loader/FrameLoader.cpp
index 9f2a338418..2b6f9bfef5 100644
--- a/Libraries/LibWeb/Loader/FrameLoader.cpp
+++ b/Libraries/LibWeb/Loader/FrameLoader.cpp
@@ -63,7 +63,7 @@ static RefPtr<DOM::Document> create_markdown_document(const ByteBuffer& data, co
 
 static RefPtr<DOM::Document> create_text_document(const ByteBuffer& data, const URL& url)
 {
-    auto document = adopt(*new DOM::Document(url));
+    auto document = DOM::Document::create(url);
 
     auto html_element = document->create_element("html");
     document->append_child(html_element);
@@ -88,7 +88,7 @@ static RefPtr<DOM::Document> create_text_document(const ByteBuffer& data, const
 
 static RefPtr<DOM::Document> create_image_document(const ByteBuffer& data, const URL& url)
 {
-    auto document = adopt(*new DOM::Document(url));
+    auto document = DOM::Document::create(url);
 
     auto image_decoder = Gfx::ImageDecoder::create(data.data(), data.size());
     auto bitmap = image_decoder->bitmap();
diff --git a/Userland/test-web.cpp b/Userland/test-web.cpp
index b8c46024f2..cf06d58d6a 100644
--- a/Userland/test-web.cpp
+++ b/Userland/test-web.cpp
@@ -686,7 +686,7 @@ int main(int argc, char** argv)
     main_widget.set_layout<GUI::VerticalBoxLayout>();
     auto& view = main_widget.add<Web::InProcessWebView>();
 
-    view.set_document(adopt(*new Web::DOM::Document));
+    view.set_document(Web::DOM::Document::create());
 
     if (show_window) {
         window->set_title("LibWeb Test Window");