RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 03:57:43 +00:00
Code Issues Activity Actions

LibWeb: Protect against dereferencing a null pending image request

Browse source 
The spec seems to neglect the potential nullity of an image's pending
request in various cases.

Let's protect against crashing and mark these cases with a FIXME about
figuring out whether they are really spec bugs or not.
This commit is contained in:
Andreas Kling 2023-05-14 10:20:03 +02:00
parent 7f3b98093e
commit 719f1db6c9
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Userland/Libraries/LibWeb/HTML/HTMLImageElement.cpp
View file

@ -385,7 +385,10 @@ after_step_6:
if (!url_string.is_valid()) { if (!url_string.is_valid()) {
// 1. Abort the image request for the current request and the pending request. // 1. Abort the image request for the current request and the pending request.
m_current_request->abort(realm()); m_current_request->abort(realm());
m_pending_request->abort(realm());
// FIXME: Spec bug? Seems like pending request can be null here.
if (m_pending_request)
m_pending_request->abort(realm());
// 2. Set the current request's state to broken. // 2. Set the current request's state to broken.
m_current_request->set_state(ImageRequest::State::Broken); m_current_request->set_state(ImageRequest::State::Broken);
@ -415,7 +418,9 @@ after_step_6:
// queue an element task on the DOM manipulation task source given the img element // queue an element task on the DOM manipulation task source given the img element
// to restart the animation if restart animation is set, and return. // to restart the animation if restart animation is set, and return.
if (url_string == m_current_request->current_url() && m_current_request->state() == ImageRequest::State::PartiallyAvailable) { if (url_string == m_current_request->current_url() && m_current_request->state() == ImageRequest::State::PartiallyAvailable) {
m_pending_request->abort(realm()); // FIXME: Spec bug? Seems like pending request can be null here.
if (m_pending_request)
m_pending_request->abort(realm());
if (restart_animations) { if (restart_animations) {
queue_an_element_task(HTML::Task::Source::DOMManipulation, [this] { queue_an_element_task(HTML::Task::Source::DOMManipulation, [this] {
restart_the_animation(); restart_the_animation();