From a86531809e788323ad192cc694ddc48885701392 Mon Sep 17 00:00:00 2001 From: Aliaksandr Kalenik Date: Sat, 7 Oct 2023 18:41:14 +0200 Subject: [PATCH] LibWeb: Destroy navigable containers not inserted into document tree This change fixes the bug where navigable containers related to a document, but not present in the tree, were never destroyed. Fixes https://github.com/SerenityOS/serenity/issues/21364 --- Userland/Libraries/LibWeb/DOM/Document.cpp | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/Userland/Libraries/LibWeb/DOM/Document.cpp b/Userland/Libraries/LibWeb/DOM/Document.cpp index 4c21a50d05..08c2c577e9 100644 --- a/Userland/Libraries/LibWeb/DOM/Document.cpp +++ b/Userland/Libraries/LibWeb/DOM/Document.cpp @@ -2714,12 +2714,11 @@ void Document::destroy() // When a frame element stops being an active frame element, the user agent must destroy a child navigable given the element. // A frame element is said to be an active frame element when it is in a document tree and its node document's browsing context is non-null. - for_each_shadow_including_descendant([&](DOM::Node& node) { - if (is(node)) { - verify_cast(node).destroy_the_child_navigable(); + for (auto& navigable_container : HTML::NavigableContainer::all_instances()) { + if (&navigable_container->document() == this) { + navigable_container->destroy_the_child_navigable(); } - return IterationDecision::Continue; - }); + } // 7. Set document's node navigable's active session history entry's document state's document to null. if (navigable()) {