From b62043dbca047cb83aa6acd3d9b6bd65c54ef15e Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Fri, 11 Sep 2020 18:37:18 +0200
Subject: [PATCH] LibWeb: Protect LayoutCheckBox against crashes after event
 dispatch

After dispatching a "change" event due to the checked state being
modified, we may have been removed from the layout tree.

Make LayoutCheckBox protect itself to prevent this from crashing.

Also, add a little test page for checkboxes. :^)
---
 Base/res/html/misc/checkbox.html           | 11 +++++++++++
 Base/res/html/misc/welcome.html            |  1 +
 Libraries/LibWeb/Layout/LayoutCheckBox.cpp |  3 +++
 3 files changed, 15 insertions(+)
 create mode 100644 Base/res/html/misc/checkbox.html
diff --git a/Base/res/html/misc/checkbox.html b/Base/res/html/misc/checkbox.html
new file mode 100644
index 0000000000..86b8198b0c
--- /dev/null
+++ b/Base/res/html/misc/checkbox.html
@@ -0,0 +1,11 @@
+<html>
+    <input id=foo type=checkbox> This is a checkbox
+    <pre id=bar></pre>
+    <script>
+        var foo = document.getElementById("foo");
+        var bar = document.getElementById("bar");
+        foo.addEventListener("change", function() {
+            bar.innerHTML += foo.checked + "\n";
+        });
+    </script>
+</html>
diff --git a/Base/res/html/misc/welcome.html b/Base/res/html/misc/welcome.html
index 3d5046bb30..3016ccb2f7 100644
--- a/Base/res/html/misc/welcome.html
+++ b/Base/res/html/misc/welcome.html
@@ -31,6 +31,7 @@ span#ua {
     <p>Your user agent is: <b><span id="ua"></span></b></p>
     <p>Some small test pages:</p>
     <ul>
+        <li><a href="checkbox.html">checkbox</a></li>
         <li><a href="canvas-rotate.html">canvas rotate()</a></li>
         <li><a href="margin-collapse-2.html">margin collapsing 2</a></li>
         <li><a href="margin-collapse-1.html">margin collapsing 1</a></li>
diff --git a/Libraries/LibWeb/Layout/LayoutCheckBox.cpp b/Libraries/LibWeb/Layout/LayoutCheckBox.cpp
index febab14800..f1d76c3352 100644
--- a/Libraries/LibWeb/Layout/LayoutCheckBox.cpp
+++ b/Libraries/LibWeb/Layout/LayoutCheckBox.cpp
@@ -80,6 +80,9 @@ void LayoutCheckBox::handle_mouseup(Badge<EventHandler>, const Gfx::IntPoint& po
     if (!m_tracking_mouse || button != GUI::MouseButton::Left)
         return;
 
+    // NOTE: Changing the checked state of the DOM node may run arbitrary JS, which could disappear this node.
+    NonnullRefPtr protect = *this;
+
     bool is_inside = enclosing_int_rect(absolute_rect()).contains(position);
     if (is_inside)
         node().set_checked(!node().checked());
