1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-06-01 10:08:10 +00:00

LibWeb: Empty CE reaction queue instead of destroying it on exception

If an exception occurs in a custom element constructor, we clear the
reaction queue by destroying it, instead of emptying the Vector.
3da6916383/Userland/Libraries/LibWeb/DOM/Element.cpp (L2033)

This causes a UAF here, as async upgrades (i.e. custom elements not
created by document.createElement) are performed in this loop:
3da6916383/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp (L657)

Fixes crash when loading https://github.com/SerenityOS/serenity
This commit is contained in:
Luke Wilde 2024-03-01 00:58:51 +00:00 committed by Tim Flynn
parent 5b4533cab8
commit 48e11a1f12
3 changed files with 24 additions and 1 deletions

View file

@ -0,0 +1,2 @@
Entered TestElement constructor, throwing.
PASS! (Didn't crash)