From c11f710628b595dfcda552cac55af6386f2aa06c Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Tue, 12 Mar 2024 10:22:19 +0100
Subject: [PATCH] LibWeb: Fix bogus insertion logic in
 HTMLTableSectionElement.insertRow()

Found by Domato :^)
---
 Tests/LibWeb/Text/expected/HTML/tbody-insert-row.txt  |  4 ++++
 Tests/LibWeb/Text/input/HTML/tbody-insert-row.html    | 11 +++++++++++
 .../Libraries/LibWeb/HTML/HTMLTableSectionElement.cpp |  2 +-
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 Tests/LibWeb/Text/expected/HTML/tbody-insert-row.txt
 create mode 100644 Tests/LibWeb/Text/input/HTML/tbody-insert-row.html

diff --git a/Tests/LibWeb/Text/expected/HTML/tbody-insert-row.txt b/Tests/LibWeb/Text/expected/HTML/tbody-insert-row.txt
new file mode 100644
index 0000000000..831a911c6a
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/HTML/tbody-insert-row.txt
@@ -0,0 +1,4 @@
+   2
+[object HTMLTableRowElement]
+[object HTMLTableRowElement]
+PASS (didn't crash)
diff --git a/Tests/LibWeb/Text/input/HTML/tbody-insert-row.html b/Tests/LibWeb/Text/input/HTML/tbody-insert-row.html
new file mode 100644
index 0000000000..e0ca77388c
--- /dev/null
+++ b/Tests/LibWeb/Text/input/HTML/tbody-insert-row.html
@@ -0,0 +1,11 @@
+<table><tbody id="tbody"><tr></tr></tbody></table>
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        tbody.insertRow(0);
+        println(tbody.rows.length)
+        println(tbody.rows[0])
+        println(tbody.rows[1])
+        println("PASS (didn't crash)");
+    });
+</script>
diff --git a/Userland/Libraries/LibWeb/HTML/HTMLTableSectionElement.cpp b/Userland/Libraries/LibWeb/HTML/HTMLTableSectionElement.cpp
index 8399379717..cd1a71f688 100644
--- a/Userland/Libraries/LibWeb/HTML/HTMLTableSectionElement.cpp
+++ b/Userland/Libraries/LibWeb/HTML/HTMLTableSectionElement.cpp
@@ -66,7 +66,7 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<HTMLTableRowElement>> HTMLTableSectionEleme
         TRY(append_child(table_row));
     // 4. Otherwise, insert table row as a child of this element, immediately before the index-th tr element in the rows collection.
     else
-        table_row.insert_before(*this, rows_collection->item(index));
+        insert_before(table_row, rows_collection->item(index));
 
     // 5. Return table row.
     return JS::NonnullGCPtr(table_row);