RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 04:12:43 +00:00
Code Issues Activity Actions

LibWeb: Don't crash in offset_parent() if no ancestor element found

Browse source 
The specification says the final step of this algorithm is to return
null. Previously, the browser would crash if the content of an iframe
was appended to the document before its offsetParent property was
queried.
This commit is contained in:
Tim Ledbetter 2024-02-29 21:53:58 +00:00 • committed by Tim Flynn
parent 3da6916383
commit 5b4533cab8
3 changed files with 25 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/Element-offsetParent-of-iframe.txt Normal file
View file

@ -0,0 +1 @@
iframe offsetParent value: null

22
Tests/LibWeb/Text/input/Element-offsetParent-of-iframe.html Normal file
View file

@ -0,0 +1,22 @@
<!DOCTYPE html>
<script src="include.js"></script>
<script>
function offsetParentOfChildDocument() {
const frameDocument = document.querySelector("iframe").contentDocument;
const frameRoot = frameDocument.documentElement;
document.documentElement.append(frameRoot);
document.dispatchEvent(new CustomEvent("offsetParentCalled", { detail: { iframeOffsetParent: frameRoot.offsetParent }}));
}
asyncTest(done => {
document.addEventListener("offsetParentCalled", event => {
println(`iframe offsetParent value: ${event.detail.iframeOffsetParent}`);
done();
});
});
</script>
<iframe srcdoc="
<script>
window.parent.offsetParentOfChildDocument();
</script>
">

3
Userland/Libraries/LibWeb/HTML/HTMLElement.cpp
View file

@ -205,7 +205,8 @@ JS::GCPtr<DOM::Element> HTMLElement::offset_parent() const
return const_cast<Element*>(ancestor);
}
VERIFY_NOT_REACHED();
// 3. Return null.
return nullptr;
}
// https://www.w3.org/TR/cssom-view-1/#dom-htmlelement-offsettop