mirror of
https://github.com/RGBCube/serenity
synced 2025-06-01 10:08:10 +00:00
LibWeb: Empty CE reaction queue instead of destroying it on exception
If an exception occurs in a custom element constructor, we clear the reaction queue by destroying it, instead of emptying the Vector.3da6916383/Userland/Libraries/LibWeb/DOM/Element.cpp (L2033)
This causes a UAF here, as async upgrades (i.e. custom elements not created by document.createElement) are performed in this loop:3da6916383/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp (L657)
Fixes crash when loading https://github.com/SerenityOS/serenity
This commit is contained in:
parent
5b4533cab8
commit
48e11a1f12
3 changed files with 24 additions and 1 deletions
|
@ -0,0 +1,2 @@
|
|||
Entered TestElement constructor, throwing.
|
||||
PASS! (Didn't crash)
|
Loading…
Add table
Add a link
Reference in a new issue